Add the e2e dev CLI: the scenario primitives, interactive

cd e2e && bun run cli — boot a target and keep it up (up [--share]),
mint identities, make typed API calls, drive MCP sessions, read the
emulator request ledger, and tear down (down). The point: develop
against a live instance with the exact machinery the tests use, then
crystallize the journey into a scenario — and the booted instance IS
the handoff demo (AGENTS.md evidence contract) and the seeding vehicle
(drive a bug repro or staged state, hand across the URL).

The boot recipes move out of the vitest globalsetups into shared
setup/<target>.boot.ts modules — one boot path for suites (ephemeral)
and the CLI (persistent, detached runner owning cloud's in-process
WorkOS/Autumn emulators). up --share binds the tailnet: plain http for
selfhost; for cloud it fronts both the app and the WorkOS emulator
with tailscale-serve HTTPS (Secure cookies) and threads the public
origins through WORKOS_API_URL / emulator baseUrl / Vite allowed
hosts. Instances are tracked in e2e/.dev/<target>.json so a deliberate
long-lived instance is distinguishable from a leak; logs land next to
the state file (boot.ts gains logFile + pids for that).

Verified: both targets up/down cleanly through the CLI, identity/api/
mcp/ledger all answer, a scenario attaches to a CLI-booted instance
via E2E_SELFHOST_URL, both refactored globalsetups boot standalone
(api-tools green on cloud + selfhost), full suite run — the two cloud
failures (sources-api envelope, auth-methods mixed-source) reproduce
identically on the clean baseline, so they predate this change.

Author: RhysSullivan

e2e/.gitignore

@@ -0,0 +1 @@
+.dev/

e2e/package.json

@@ -4,6 +4,7 @@
   "private": true,
   "type": "module",
   "scripts": {
+    "cli": "bun scripts/cli.ts",
     "test": "vitest run --project cloud && vitest run --project selfhost",
     "test:cloud": "vitest run --project cloud",
     "test:selfhost": "vitest run --project selfhost",