feat: Use Seam CLI adapter to store state

[razor-x]

Summary

The wizard reached into the Seam CLI's cli.json for the developer's login, re-derived the CLI's XDG paths with its own copy of env-paths, and reimplemented its auth precedence — two codebases agreeing by coincidence. And it adopted whatever SEAM_API_KEY it found without recording anything, so it could not tell a project set up against one workspace from the same project now pointed at another.

WizardAdapter arrived in #11 and 0.7.0. This is what puts it to use. The Seam CLI implements it as of @seamapi/cli@0.23.0.

What it asks the adapter for

• The developer's login, instead of opening cli.json — cli-auth.ts and its copies of the CLI's paths and precedence are gone, along with the configstore and env-paths dependencies. The hand-rolled seam_at / seam_cst prefix matching goes too: an adapter that knows what an API key is says so.
• Where the record goes, instead of .seam/onboarding.json — a run is local to whoever ran it, so it does not belong in someone's repository.

What the whole team needs is written into the project instead: the key in .env, the variable in .env.example, and .env added to .gitignore.

What a project connects with

The wizard records what a project was set up to talk to — endpoint, workspace, and a fingerprint of the key — leaving three states, of which only the last asks a question:

1. Nothing recorded. The developer chooses, with whatever was found offered first and named by its workspace:

   > Use the SEAM_API_KEY in .env.local  (workspace Acme)
     Use your Seam CLI login  (workspace Acme Staging)
     Continue in your browser
     Paste an API key
   

2. Recorded, and the environment still says the same. The run carries on without asking.
3. Recorded, and the environment says something else. What moved is named, and the choice is directional:

   This project was set up with something else:
     API key: one ending 1111 → one ending 2222
     Workspace: Acme → Other
   > Update this project to use the SEAM_API_KEY in .env.local  (workspace Other)
     Change what this project connects with…
     Quit, and leave everything as it is
   

The key itself is never recorded — only a digest to compare and the last four characters to recognize it by. Enough to notice a key changing, not enough to use one, which is why the second option asks for a key rather than putting the old one back.

Changed

• New lib/steps/connection.ts — comparing what a project was set up with against what its environment says now, as a pure function over a record.
• New lib/util/api-key.ts — the fingerprint.
• New lib/store/ — the record (connection / plan / result), and the remembered SDK, read and written through the adapter.
• lib/app.tsx — the three states and the prompts for each. The record is written when the connection settles rather than only when the agent runs, since that is what a later run reads.
• @seamapi/cli as a devDependency — npm run wizard runs this wizard as seam wizard through the real CLI, which now hands it a real adapter.

Verified

Driven through the published CLI, with the dev entry's own resolution:

auth from the published CLI: { endpoint: 'https://connect.getseam.com',
                               apiKey: 'seam_apikey1_…', workspaceId: null }
~/.config/seam/wizard.json        ← config.set('sdk', 'python')
~/.local/state/seam/wizard.json   ← state.set('projects.…', record)

117 tests, including every state transition and that no record ever contains a key.

Not done here

The README documents the wizard as it was, so this flow is undocumented.