Adopt UX/DX conventions from the Codex/Gemini/Antigravity CLIs

[alexkroman]

Aligns the CLI with the conventions the leading agent CLIs converge on,
scoped to client-only changes:

• login: new --with-api-key reads the key from stdin (Codex pattern) so
  it never reaches shell history or ps; --api-key becomes a hidden
  deprecation trap that still works but warns toward the stdin form.
  The browser-flow fallback now prints the exact ssh -L port-forward
  command (honoring AAI_AUTH_PORT) plus the stdin recipe for
  headless/SSH machines.
• new assembly config group (path/list/get/set) over config.toml:
  switch the active profile, bind a profile's env, toggle telemetry —
  with bare pipe-friendly values on get/path.
• new assembly update: --check reports the latest release; otherwise
  detects the install channel (brew/pipx/uv) and runs that channel's
  own upgrade command, codex-update style.
• root --color auto|always|never (rebuilds the shared consoles and sets
  NO_COLOR/FORCE_COLOR for late-created consoles and children).
• llm: --config KEY=VALUE escape hatch for any gateway request field
  (JSON-typed values, literal-string fallback), matching the
  transcribe/stream --config convention.
• every NDJSON stream line now carries a "type" discriminator
  (dictate: utterance, llm --follow: answer, batch transcribe: result;
  stream/agent already had one).
• hidden assembly t alias for transcribe (codex e/a pattern).
• [sandbox] availability prefix on speak/dub help (codex
  [EXPERIMENTAL] labeling convention).
• REFERENCE.md pins the script-facing contracts: exit codes, env vars,
  config precedence, the stdin login recipe, and the NDJSON event
  vocabulary; AGENTS.md records the new conventions.

https://claude.ai/code/session_013GPR7DWS56HmxWvCJgofPb