feat: Reuse existing SSO auth sessions

[cloudsmith-iduffy]

Summary

• reuse a renewable SSO session before prompting for a Workspace or opening a browser during ordinary cloudsmith auth
• report session status and access-token expiry in human-readable and structured output
• preserve the existing explicit and deprecated --token, --force, and --json flows, including token rotation behavior and warnings

Validation

• pytest -q cloudsmith_cli/cli/tests/commands/test_auth.py
• pre-commit run --files cloudsmith_cli/cli/commands/auth.py cloudsmith_cli/cli/tests/commands/test_auth.py CHANGELOG.md
• git diff --check

Top layer of native stack #411, based on #408.

[cloudsmith-iduffy]

@copilot resolve all conflicts

[Copilot]

Pull request overview

This PR updates the cloudsmith auth command to reuse an existing renewable SSO session (when available) so users can avoid unnecessary workspace prompts/browser flows, and it surfaces SSO session status + access-token expiry in both human-readable and JSON output.

Changes:

• Add an early-path in cloudsmith auth to renew/reuse an existing SSO session and short-circuit the browser flow when successful.
• Add structured JSON reporting for SSO session status, method, expiry timestamp, and renewal errors.
• Extend CLI tests to cover the “reuse session” behavior, JSON output, and an actionable offline failure mode.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
cloudsmith_cli/cli/commands/auth.py	Adds SSO session reuse + reporting helpers and wires them into the authenticate command flow.
cloudsmith_cli/cli/tests/commands/test_auth.py	Adds regression tests for session reuse, JSON output shape, and offline-expired-session behavior.
CHANGELOG.md	Documents the new SSO session reuse and expiry reporting behavior for cloudsmith auth.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

@copilot resolve all conflicts

Resolved the branch conflicts and pushed the follow-up fixes in 4c7bbc4 (merge resolution), 418c7ad (bounded auth callback wait), and 519e72d (sanitized OIDC decode warnings).