refactor(cli): route gateway transport through Rust SDK #4816

User Story

I maintain and use OpenShell's CLI and Rust SDK. I need gateway transport behavior to have one owner so CLI and SDK authentication and TLS behavior do not drift, and transport dependencies remain scoped to the SDK.

Description

The CLI depends on openshell-sdk, but it still constructs its own gRPC channel, TLS and mTLS configuration, authentication interceptor, and Cloudflare edge tunnel. Consolidate channel construction in openshell-sdk while preserving CLI behavior and raw RPC coverage.

Context

• The CLI duplicates SDK channel and edge tunnel code.
• The SDK currently lacks an input for a client certificate and private key; an in-memory client identity closes that gap without adding filesystem concerns to the SDK.
• CLI commands can retain generated RPC coverage through the SDK's raw_grpc() escape hatch.
• This change should not alter CLI commands, flags, output, or gateway compatibility.
• Migrating individual commands to curated SDK methods, adopting live SDK OIDC refresh, and switching the TUI between gateways can be evaluated as follow-up work.

Definition of Done

• openshell-sdk supports an in-memory client identity for mTLS.
• CLI gRPC channel creation delegates to the SDK for plaintext, verified and insecure TLS, mTLS, OIDC authentication, and Cloudflare edge connections.
• CLI commands and dynamic completions use the SDK-backed raw gRPC client without behavior regressions.
• Duplicate CLI edge tunnel code and direct transport dependencies are removed.
• Focused SDK and CLI tests pass, including integration coverage with a server that requires a client certificate.