fix(cli): a config kates cannot read or parse fails API calls instead of sending them to localhost:8080 without a key

[bmscomp]

Item 1.2 of the CLI performance and stability plan (finding F6). Independent of the other Wave 1 PRs.

Why

A malformed ~/.kates.yaml sends every command to localhost:8080 without the API key. On main (6f4cf61):

• loadConfig only warns (cli/cmd/root.go:65-72).
• A parse error returns empty contexts (:82-103).
• The empty current context resolves to the built-in http://localhost:8080 context (:317-318).

So a YAML typo in a file whose current context is prod sends every command to whatever listens on 8080, with no API key. That can be a stale kates ports forward to another cluster, and a DELETE goes there too.

The new test shows it. Run against main's root.go while writing it, kates health with a broken config printed "System Status: UP": it reached the Kates API behind the port-forward on this machine's 8080. That was one GET of health.

Changes

cli/cmd/root.go:

• When the config file exists but cannot be read or parsed, and neither --url nor KATES_URL names the server, the root pre-run sets the context error. Every API call then fails through client.Failing, as fix(cli): a context that does not exist is an error, not localhost #274 does for an unknown context. The message names the file and the cause, and says "Fix the file, or pass --url or set KATES_URL".
• Commands that never call the API still run. The existing warning is unchanged.
• loadConfig keeps its signature for its other callers (11 in the product, more in tests). The new loadConfigErr returns the error it warned about, and only the pre-run uses it.

A missing file still means the built-in default context, as before.

Tests

Added TestUnreadableConfigReachesNoServer, which runs the test binary as kates with a broken config in its home (KATES_TEST_HOME):

• health exits 1 after no request, and the error says "could not load config" and names .kates.yaml.
• --url <server> test list and KATES_URL=<server> test list reach that server and exit 0.

runKatesCLI is now a wrapper over runKatesCLIConfig, which takes the config text.

On main's root.go the test fails with exit 0 after 0 requests, because the command went to localhost:8080 instead.

Run locally, passing:

• cd cli && go test ./..., go test -race ./cmd, go vet ./....
• golangci-lint run --new-from-rev=origin/main ./...: 0 issues.
• scripts/check-cli-style.sh and scripts/check-cli-compat.sh: OK.
• The backend suite, which cli/** triggers (Build & Test): this PR touches nothing under kates/. ./mvnw test on main's kates/ tree ran 1,254 tests with 0 failures and 0 errors, once for all of Wave 1.

Skipped locally: govulncheck, as go.mod is unchanged.

CI only: ./mvnw verify with the *IT tests, the Kind and Docker jobs, CodeQL and Trivy.