feat(install): let the user pick the environment during install

[nicknisi]

Stacked on #229 (uses its project-prefixed names in the picker labels). Retarget to main after #229 merges.

Why

From the Slack thread: a fresh npx workos@latest run silently installed against staging-3 — the active profile — with no indication of which dashboard environment that is, and no chance to change it. The installer writes those credentials into the project.

What

When more than one stored profile carries an API key and prompting is allowed, install pre-flight asks:

? Which WorkOS environment should this install use?
❯ staging — Nick's Team's Project > test12            Sandbox
  staging-3 — cli-branding-smoke > Staging (active)   Sandbox

• Lives in resolveInstallCredentials, the shared pre-flight for all three install entrypoints (workos install, bare npx workos, dashboard path) — before the state machine starts, so no spinner conflicts
• Choice persists via setActiveEnvironment: the install and every later command agree on the target
• Never prompts: explicit WORKOS_API_KEY/--api-key, CI/agent/JSON modes, single-profile configs. Cancel exits 2 like the installer's other prompts
• Offers local profiles, not all team environments: the dashboard catalog has no create-key operation, so profiles are the only environments the CLI holds usable credentials for

Verification

2713 tests passing (6 new covering: prompt + persist, re-choose active is a no-op write, single-profile silence, non-interactive silence, cancel semantics), typecheck clean.

[greptile-apps]

Greptile Summary

The PR adds an install-time environment picker and threads project-scan context into staging credential resolution.

• Prompts interactive users to select among locally keyed profiles and persists the selection.
• Suppresses selection for explicit/project-owned credentials and non-interactive output modes.
• Routes consented key-only projects through manual credential entry, but that fallback can still replace the existing project key.

Confidence Score: 4/5

The PR is not yet safe to merge because the key-only-project fallback can still replace the project's existing API key.

A consented scan of a key-only project now routes to manual credential entry, but the prompt collects another API key and the configuration writer overwrites the existing project value without ensuring it is preserved or belongs to the same environment.

Files Needing Attention: src/lib/resolve-install-credentials.ts, src/lib/run-with-core.ts

Important Files Changed

Filename	Overview
src/lib/resolve-install-credentials.ts	Adds profile selection and key-only-project handling, but the manual fallback does not preserve the existing project API key.
src/lib/installer-core.ts	Passes install-directory and scan-consent state into staging resolution and routes failures to manual credential entry.
src/lib/run-with-core.ts	Delegates staging resolution to the new helper; the existing configuration writer applies the manually submitted API key over project state.
src/lib/resolve-install-credentials.spec.ts	Covers selection and staging branches but does not verify that manual fallback preserves a key-only project's API key.
src/lib/installer-core.spec.ts	Updates the staging actor input type to match the new state-machine contract.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Consent to project env scan] --> B{Valid client ID found?}
  B -->|Yes| C[Configure with discovered credentials]
  B -->|No, valid project API key exists| D[resolveStagingCredentials throws]
  D --> E[Manual credential prompt]
  E --> F[Submit client ID and API key]
  F --> G[configureEnvironment]
  G --> H[Existing project API key is replaced]

Loading

Prompt To Fix All With AI

### Issue 1
src/lib/resolve-install-credentials.ts:95-97
**Project key still replaced**

When a consented environment scan finds a valid `WORKOS_API_KEY` without a valid `WORKOS_CLIENT_ID`, this throw routes the installer to a manual prompt that collects a complete pair. The configuration step then writes the submitted API key over the project's existing key, so entering a key from another environment silently re-points the application despite the no-clobber handling.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (7): Last reviewed commit: "chore: formatting" | Re-trigger Greptile}

[greptile-apps]

Project key still replaced

When a consented environment scan finds a valid WORKOS_API_KEY without a valid WORKOS_CLIENT_ID, this throw routes the installer to a manual prompt that collects a complete pair. The configuration step then writes the submitted API key over the project's existing key, so entering a key from another environment silently re-points the application despite the no-clobber handling.

Knowledge Base Used:

• Application installation workflows
• Installer orchestration and project mutation
• Configuration and environment management

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/lib/resolve-install-credentials.ts
Line: 95-97

Comment:
**Project key still replaced**

When a consented environment scan finds a valid `WORKOS_API_KEY` without a valid `WORKOS_CLIENT_ID`, this throw routes the installer to a manual prompt that collects a complete pair. The configuration step then writes the submitted API key over the project's existing key, so entering a key from another environment silently re-points the application despite the no-clobber handling.

**Knowledge Base Used:**
- [Application installation workflows](https://app.greptile.com/workos/-/custom-context/knowledge-base/workos/cli/-/docs/application-installation.md)
- [Installer orchestration and project mutation](https://app.greptile.com/workos/-/custom-context/knowledge-base/workos/cli/-/docs/installer-orchestration.md)
- [Configuration and environment management](https://app.greptile.com/workos/-/custom-context/knowledge-base/workos/cli/-/docs/configuration-and-environment-management.md)

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.