feat(outpost): Outpost API client and command tree

[leggetter]

Adds Outpost support to the CLI: the API client layer and the full hookdeck outpost command tree. Part of #346. MCP (Phase 3) is not in this PR — it follows separately so the shared-plumbing refactor can be reviewed on its own.

Draft: the commands work and are tested, but have not been exercised by real users. The intent is to cut a v2.6.0-beta.1 from this branch, test in the real world, then merge.

What's here

hookdeck outpost
├── tenant            list · get · upsert · delete · token · portal
├── destination       list · get · create · update · delete · enable · disable
├── destination-type  list · get
├── event             list · get · retry
├── attempt           list · get
├── publish
├── topic             list
├── metrics           events · attempts
├── config            get · set · custom-domain (get · set · delete)
└── status

Plus the client layer (pkg/hookdeck/outpost_*.go), a destination-type schema cache, an outpost acceptance slice, and docs.

Three things worth a reviewer's attention

1. Config and credentials are key=value pairs, not flat flags.

hookdeck outpost destination create --tenant-id acme --type webhook \
  --config url=https://example.com/hooks

This departs from the flat-flag convention (--url, --bearer-token) used by gateway commands. Cobra registers flags at init, but destination fields differ per type and are only known after fetching the schema — declaring them would mean a network call before a command could parse its own arguments. The schema is still used, for validation and help. Dotted paths (--config a.b=c) are supported so a nested type shipping server-side would not need a CLI release.

This creates a genuine inconsistency: --config means "JSON object" in gateway commands and "key=value" here. Tracked in #347 with a proposed resolution (accept both formats in gateway — additive, so a minor).

2. --type <type> --help lists that type's fields.

Since --config alone cannot say which keys are valid, help does. Cobra parses flags before running the help function, so once a type is named it shows exactly that type's fields — cache-first, degrading silently to static help when unauthenticated, offline, or cold. Plain --help is unchanged and needs no network or credentials.

REFERENCE.md is provably unaffected: the generator reads command metadata directly and never invokes help. Verified with warm and cold caches, and pinned by a test asserting help never rewrites Long or flag usage.

3. outpost publish needs a Project API key.

It is the one command that does not accept the credentials hookdeck login stores, so it has its own --api-key defaulting to HOOKDECK_API_KEY, in the same shape as hookdeck ci. Without one it fails with its own guidance rather than a bare 401. Documented in README and AGENTS.md.

Two bugs the live tests caught

Both were invisible to unit tests, which is why a build-tagged live suite exists (test/acceptance/outpost_live_test.go, outpostlive):

• Destination-type options is [{label, value}], not []string. Decoding the real endpoint failed outright. The stub fixture had encoded the wrong shape, which is exactly why the unit tests passed. Surfaced on kafka — a type missing from the published OpenAPI enum but live in the API.
• Only HTTP 200 was treated as success. The Event Gateway API answers 200 to everything so this never surfaced, but Outpost uses 201 on create and 202 on publish/retry — every write failed. Fixed with an opt-in Client.AcceptAnySuccessStatus, set on the Outpost client only, so gateway behaviour is unchanged.

Testing

• go build, go vet, go test ./... green
• outpost acceptance slice run locally against a real Outpost project before committing, plus the gateway slice for the project-gate rejection test
• Live suite run against the real API: tenant and destination CRUD, the topics union decoding the bare "*" form, publish, retry, event and attempt reads
• CI gains a fourth acceptance slice backed by HOOKDECK_CLI_OUTPOST_TESTING_API_KEY — this PR is its first run

Notes for review

• 8 commits, each self-contained; reviewing commit-by-commit is likely easier than the combined diff
• Eight pkg/hookdeck/*.go files show as modified but are gofmt-only — they were already unformatted on main
• Error assertions in the acceptance tests read stdout, not stderr, because that is where the CLI currently writes errors (Epic: make the CLI safe and predictable for agents and automation #340). Commented so they fail loudly if that contract changes rather than passing vacuously