CLI: provide a safe observer-token provisioning command

[willwashburn]

Problem

The credential-safety fix in #1405 removes workspace administration keys from observer URLs. Six shipped plugin instruction files now tell agents that observation requires a separately provisioned, read-only ot_live_... observer token delivered through an explicit secret handoff:

• plugins/codex-relay-skill/SKILL.md
• plugins/gemini-relay-extension/GEMINI.md
• the Gemini fanout, status, and team commands
• plugins/gemini-relay-extension/hooks/session-start.sh

There is no corresponding agent-relay CLI command for an operator to mint that token. Without a supported CLI surface, the safe guidance can make observation unavailable even though the underlying capability exists.

Verified boundary

This is not a claim that Relay has no observer-token provisioning path:

• crates/broker/src/listen_api.rs exposes POST /api/observer-token and routes it through ListenApiRequest::CreateObserverToken.
• The broker runtime mints the endpoint's minimal read-only scope set and recovers eligible same-name conflicts by rotation.
• E2E helpers call the API directly.

The gap is specifically the CLI. A production-source search under packages/cli/src/cli finds no observer-token command or mint call. Its only token-shaped references are redaction support and cloud-room.ts rejecting observerToken in a participant-session response.

Evidence is source/grep-level over the CLI package plus direct inspection of the broker endpoint; a web or dashboard flow may also exist.

Expected behavior

Add a supported CLI flow that provisions an observer token through the existing broker/API contract and makes the secret handoff explicit and safe. It should:

• mint only the established read-only observer scopes;
• avoid printing raw token material by default;
• support an owner-only 0600 token file as the normal sink, with any stdout/JSON secret reveal requiring an explicit opt-in;
• identify the selected workspace unambiguously;
• document the command in the shipped Gemini and Codex guidance so an operator can satisfy the handoff requirement;
• test scope selection, secret-output behavior, file permissions, and failure handling.

Credit

Found by cso while reviewing #1405. This issue narrows the original negative finding after verifying the existing broker HTTP mint endpoint.