feat(setup): Add AI-CLI Pup Setup command - #881

`pup setup` runs Datadog's AI Setup CLI with
`npx -y --package @datadog/ai-setup-cli@latest ai-setup-cli`, passing every
argument through. AI Setup is already published to npm, so this needs no
extension install, release repository or checksums, at the cost of
requiring Node.js 22+ when `setup` runs.

- Checks for Node.js 22+ and npx, prints how to install what is missing,
  and sends one best-effort log event (setup_prerequisite_missing,
  service:setup-cli, 2s timeout) to the Datadog logs intake, the channel AI
  Setup uses for its own telemetry, so we can measure how often Node is
  missing. It needs no login, and includes the org UUID (dd_oid) when pup
  has a session.
- Forwards pup's session as DD_ACCESS_TOKEN. When an OAuth session exists,
  shell API/app keys are dropped, and a lone key is never forwarded. The
  help lookup uses the same environment.
- `--site` passed to setup becomes pup's site for the run, so the site
  check, the forwarded session and AI Setup's `--site` all agree.
- Adds --headless when an AI agent is detected (unless --no-agent) or
  stdin/stdout isn't a terminal; a person at a terminal gets AI Setup's
  interactive flow unless they pass --headless.
- Headless runs with no session point people without an account to the
  sign-up page and run pup's OAuth login first. At a terminal, AI Setup's
  own sign-in runs, and pup offers to log in too after a successful run.
- Logins started by pup setup request api_keys_read, which AI Setup needs
  to write the org's API key into the project. A saved session without it
  gets one more login; `pup auth login` is unchanged. `auth::login` now
  returns the session it saved, so setup continues with the right session
  when the login lands in another region or org.
- `pup setup --help` builds a setup command from AI Setup's --help --json
  and renders it as clap help, so new products and flags show up without
  a pup release. `pup setup help` and `pup help setup` are aliases.
- `pup agent schema setup` says setup passes AI Setup's output through
  (ending with an AI_SETUP_RESULT line in headless runs) instead of
  returning an API body.
- pup's global flags work after `setup`, and `pup setup --read-only` is
  blocked, though `pup setup --help` still works in read-only mode.
- PUP_SETUP_AI_SETUP_PACKAGE overrides the package spec (version, tag,
  tarball path or file: spec) to test unreleased AI Setup builds.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>