CLI Extensions — Stage 5: auth command + CommandRunner infrastructure #264

Part of the EdgeZero CLI Extensions effort — stage 5 of 8.

Scope: add the private CommandRunner infrastructure (runner.rs: CommandSpec { program, args, cwd, stdin, env }, CommandRunner trait, RealCommandRunner, MockCommandRunner for tests). Add the auth command — AuthArgs (subcommand-wrapping, no Default), AuthSub { Login, Logout, Status } each with --adapter, and run_auth. Per-adapter behaviour delegates to the native CLI: axum no-ops; cloudflare wrangler login/logout/whoami; fastly fastly profile create/delete/list; spin spin cloud login/logout/info. Wire app-demo-cli auth.

Ship gate: mock-runner verification across the full (adapter, sub) matrix, including tool-not-found and non-zero-exit cases.

Design spec: §11, §6.1 — Implementation plan: Stage 5.