rbio: add debug:* diagnostics (env, deps, venv)

[davidsmejia]

Issue Number

#3572

Purpose/Implementation Notes

• bin/lib/_requirements.py - extend @requires with env_alternatives, used for AWS auth where "AWS_PROFILE OR AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY)" is the rule. The decorator structure is (label, [option_a, option_b, ...]) where each option is a list of vars that together (AND) satisfy that option; outer list is OR. epilog_from() renders the alternatives in --help output too.

• bin/lib/debug.py (new) — three read-only diagnostic commands:

  • debug:env - flat aggregate by default; --for for scoped view. Shows required env vars, alternative groups (with per-option AND/OR detail and a satisfied/missing status line), optional vars. Secret-named vars (PASSWORD/SECRET/TOKEN/KEY) are masked with mask-all-but-last-4.
  • debug:deps - union of every command's tool deps (or scoped via --for). Reports missing tools, exits non-zero with "run install:deps" hint when anything is absent.
  • debug:venv - uses pip install --dry-run --report - against each subproject's requirements.txt to compare installed packages vs declared deps. Catches the "I updated requirements.txt and forgot to install:venv" gotcha without relying on mtimes.

• bin/lib/deploy.py, bin/lib/ops.py - declare the AWS auth alternative group via env_alternatives. (Duplicated string-literally for now; extracting a shared AWS_AUTH constant is tracked as a follow-up.)

• bin/rbio - register the debug namespace.

Methods

N/A

Types of changes

• New feature (non-breaking change which adds functionality)

Functional tests

N/A

Checklist

• Lint and unit tests pass locally with my changes

Screenshots

N/A