Launch the Coana CLI from Socket's servers instead of npm

[Oskar Haarklou Veileborg (BarrensZeppelin)]

Fixes REA-876. This is the Python counterpart of REA-875, which made the same change in socket-cli.

Coana releases are moving from npm to a private GCS bucket, which the Socket API hands out signed download URLs for. The reachability launcher now follows the "Launching Coana" steps in coana-package-manager's packages/cli/docs/gcs-releases.md:

1. It looks the version up with node coana-cache.mjs lookup <version> cli. The script is vendored from coana-package-manager, where it is generated, and is the only code that reads or writes the cache Coana shares with the Socket CLIs.
2. On a miss it requests the cli component from POST /orgs/<org>/coana-cli/artifacts, downloads the signed URL while checking its size and sha256, and renews a refused URL once.
3. It extracts the tarball with tarfile (with the data filter, keeping only regular files and directories, where the interpreter has it) and runs coana-cache.mjs install.
4. It runs node <dir>/cli-wrapper.mjs, now with SOCKET_CLI_API_BASE_URL derived from BASE_API_URL.

Other changes:

• A --reach-version that only matches releases from before the move fails with the API's explanation. CliClient now includes the API's error.message in APIFailure, so failed API requests elsewhere show it too.
• The npx launcher, the npm-install fallback and SOCKET_CLI_COANA_LAUNCHER (and its legacy variables) are gone. The reachability requirements check no longer asks for npm and npx.
• ReachabilityAnalyzer takes the CliClient instead of the SDK and the token. TLS verification for both the download and Coana follows the client's config.
• The Docker image no longer installs @coana-tech/cli globally; it still installs the socket CLI.
• Version bumped to 2.11.0.

Testing: the unit tests now run the real coana-cache.mjs against a fake cli-wrapper.mjs in a temporary cache, as socket-cli's tests do, instead of mocking subprocess. Like socket-cli, they don't cover the download. I smoke-tested the download against the production API: 15.12.8 downloads, installs and reports its version, a second run hits the cache, ^15.12.8 and latest resolve, and 15.0.0 fails with the API's "need an older Socket CLI" message.

Follow-up: the bump-PR job in Coana's publish-cli.yml needs to update DEFAULT_COANA_CLI_VERSION and the vendored coana-cache.mjs for this repository.

Expected reviewer effort: Full code review

---

Note

Medium Risk
Reachability now depends on the artifacts API, signed downloads, and on-disk cache behavior; misconfiguration or API changes could break --reach, though behavior mirrors the Node CLI and is covered by updated tests.

Overview
Release 2.11.0 replaces the reachability engine bootstrap: the Coana CLI is no longer run via npx / npm install of @coana-tech/cli. It is resolved through the Socket API (POST …/coana-cli/artifacts), downloaded with size/sha256 checks, installed into a shared cache via vendored coana-cache.mjs under $XDG_CACHE_HOME/socket/coana/v1, and executed as node …/cli-wrapper.mjs. SOCKET_CLI_COANA_LAUNCHER and related npm fallbacks are removed; --reach preflight now requires only node and uv (not npm/npx).

ReachabilityAnalyzer is wired through CliClient (API token, base URL, TLS settings) and sets SOCKET_CLI_API_BASE_URL for Coana. Failed API calls surface the server’s error.message in APIFailure. Docs, changelog, Docker (drops global @coana-tech/cli), and CI path filters for .mjs are updated; reachability unit tests exercise the real cache helper with a fake wrapper instead of mocking subprocess.

^{Reviewed by Cursor Bugbot for commit 181821d. Configure here.}