fix(cli): declare the os environments session widening and correct the active-environment header

The five subcommands now accept the cloud.json session they used to
refuse, so the changeset declares Clause-② yes (widening) at minor. The
active-environment.ts header no longer says os environments authenticates
only as the runtime identity.

Claude-Session: https://claude.ai/code/session_01VvcEokUG1tvVxkceYfR5XB
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/21360-environments-cloud-session.md

@@ -1,10 +1,10 @@
 ---
-'@objectstack/cli': patch
+'@objectstack/cli': minor
 ---
 
 `os environments list | show | create | bind | switch` run on the `os cloud login` session
 
-Clause-②: no
+Clause-②: yes (widening)
 
 The documented hosted flow is `os cloud login`, then `os environments create`. The five
 `os environments` subcommands read only `~/.objectstack/credentials.json` (the `os login`

packages/cli/src/utils/active-environment.ts

@@ -26,10 +26,10 @@
  *
  * ## Two stores, two active environments
  *
- * `os environments switch` keeps writing `credentials.json` (that is the copy
- * `createApiClient` reads for the `data` / `meta` / `environments` families,
- * and `os environments` authenticating as the runtime identity is deliberate).
- * When the control plane it just talked to IS `cloud.json`'s server, it records
+ * `os environments switch` keeps writing `credentials.json` when it ran on that
+ * file's session (it is the copy `createApiClient` reads for the `data` / `meta`
+ * families, and `os environments` runs on either stored session, chosen once in
+ * `createControlPlaneApiClient`). When the control plane it just talked to IS `cloud.json`'s server, it records
  * the same id there too — and that is the copy the publish reads back.
  *
  * ## Two writers, ONE gate