CLI: Update Go SDK to c0428370612f0ae242d9c4cbbf87e6a6436ff9d9 - #231

Bump github.com/kernel/kernel-go-sdk to
v0.91.1-0.20260817203807-0a287359dcc5 (0a28735).

Coverage gap found by enumerating all 140 methods in the SDK's api.md
against the CLI command tree: the new Organization.Entitlements resource
had no CLI surface. Everything else was already covered.

New command:
- `kernel org entitlements get` for client.Organization.Entitlements.Get
  (GET /org/entitlements). Renders Plan, Features, and Limits sections;
  supports --output json.

Null constraint values mean unlimited in this API, and the SDK models
them as non-pointer int64, so rendering keys off respjson field validity
rather than the zero value.

Tested against the real API:
- kernel org entitlements get (table output, ENTERPRISE plan)
- kernel org entitlements get --output json
- kernel org entitlements get --output yaml (rejected as expected)
- go build ./... and go test ./... pass, including 5 new unit tests
  covering populated constraints, null-as-unlimited, null plan fields,
  invalid --output, and API errors.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Updates github.com/kernel/kernel-go-sdk from
v0.91.1-0.20260817203807-0a287359dcc5 to v0.92.0.

## Coverage Analysis

Diffing the two module sources shows the SDK API surface is byte-identical
between these versions -- the only changes are release metadata
(.release-please-manifest.json, CHANGELOG.md, README.md, internal/version.go).

A full enumeration was still performed:
- All 140 SDK methods in api.md have corresponding CLI commands.
- The 4 x-cli-skip endpoints (/site-configs/lookup, /site-configs/resolve,
  /site-configs/analyses/{id}, /auth/connections/{id}/exchange) are absent
  from the SDK surface, so nothing to skip.
- All params struct fields are covered by CLI flags except three, each
  intentional:
  - AuthConnectionLoginParams.BrowserTelemetry -- deprecated in favor of
    browser.telemetry, which the CLI already uses via ManagedAuthBrowserConfigParam.
  - AuditLogListParams.PageToken -- opaque cursor handled internally by
    ListAutoPaging; CLI exposes --limit instead.
  - BrowserCurlParams.TimeoutMs / ResponseEncoding -- `browsers curl` is
    implemented against browsers.HTTPClient rather than the SDK curl endpoint;
    --max-time covers the timeout and raw bytes are streamed, so response
    encoding is not applicable.

No coverage gaps found; no new commands or flags added.

## Tested
- go build ./... and go vet ./... clean
- go test ./... all packages pass
- Smoke tested rebuilt binary against the live API: `kernel browsers list`

Triggered by: kernel/kernel-go-sdk@a156820

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Bumps kernel-go-sdk to v0.92.1-0.20260819203102-467fea72ee93, which adds
the proxy_error browser telemetry event (BrowserProxyErrorEvent) to the
telemetry event union.

No CLI coverage gaps: a full enumeration of all 137 SDK methods in api.md
found a corresponding CLI command for each, and the new event type needs
no code change because the telemetry commands render category/type
generically and accept --types values without a fixed allowlist.

Tested: go build ./..., go vet ./..., go test ./... (all pass);
browsers create --telemetry all, browsers curl, browsers telemetry events
(table, --output json, --categories network --all, --types proxy_error),
browsers telemetry stream --categories network --types proxy_error,
browsers delete — all against the live API.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Bumps github.com/kernel/kernel-go-sdk to
08023260493e4584c4d87638849ab4491b34ec49 (v0.93.0).

The 0.93.0 release only changed version/changelog metadata relative to
the SDK revision the CLI was already pinned to (467fea7); api.md and all
generated Go sources are byte-identical, so there are no new methods,
params, or fields to expose.

Coverage analysis: full enumeration of all 140 SDK methods in api.md
against the CLI command tree found no gaps. Every method has a command,
and every param struct field is reachable via a flag, a positional arg,
or a derived value.

Tested: go build ./..., go vet ./..., go test ./... (all pass), plus live
API smoke tests for browsers list/create/get/delete, browsers telemetry
events, auth connections list, profiles list, telemetry destinations list.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

…m split

Updates kernel-go-sdk to 9a36566d8999ca346a9eeccede0cbf88d651b93f, which mirrors
the control/platform telemetry split into the public API. BrowserTelemetryCategories
gains a `platform` category and `control` becomes its own config type carrying
`cdp.excluded_methods`, so the previous `p.Control = on()` no longer compiled.

New coverage:
- `--telemetry=platform` is now a settable category on browsers create/update,
  browser-pools create/update/acquire, and auth connections create/update/login,
  and is reported by the telemetry summaries and details tables.
- `--telemetry-cdp-exclude` (new flag, same eight commands) sets
  BrowserTelemetryCdpControlConfigParam.ExcludedMethods. Values are the 38 CDP
  methods the proxy reports, matched case-insensitively and canonicalized;
  `--telemetry-cdp-exclude=none` sends an empty list to report every method again.
  Combining it with `--telemetry=off` is rejected, and on auth connection
  update/login it requires `--telemetry` in the same command, since a connection
  stores its browser config as sent and exclusions alone would drop its category
  selection.
- Excluded methods are surfaced in the create/update telemetry summary, the
  browser-pool details table, and the auth connection details table.

A full enumeration of the 140 methods in api.md against the CLI command tree found
no missing commands. The x-cli-skip endpoints (site-configs, auth connection
exchange) remain excluded.

Tested against the live API: browsers create/update/delete with
--telemetry=control,platform --telemetry-cdp-exclude (set, replace, and =none
clear); browser-pools create/get/update/acquire/delete; auth connections
create/get/update/delete; browsers telemetry events --categories platform; and the
unknown-method, --telemetry=off, and missing---telemetry error paths.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

… split

Updates kernel-go-sdk to c0428370612f0ae242d9c4cbbf87e6a6436ff9d9.

The previous update (f9b126f) targeted SDK commit 9a36566d8999, which is not
reachable from the SDK's main branch — that telemetry control/platform split
never landed. Against c042837 the CLI no longer compiled:
BrowserTelemetryControlConfigParam, BrowserCdpCommandMethod, the `platform`
category, and `control.cdp` do not exist. This reverts f9b126f's code changes,
so the CLI is back to the nine categories the SDK actually ships (captcha,
connection, console, control, interaction, network, page, screenshot, system)
and the `--telemetry-cdp-exclude` flag is gone.

The only API-surface change between the CLI's previous SDK and c042837 is
browser_routing.go adding "computer" and "playwright" to the direct-to-VM
routing allowlist — an internal default with no CLI-visible effect.

Coverage analysis: a full enumeration of the 140 methods in api.md against the
CLI command tree found no missing commands, and a field-by-field pass over
every Params struct found no missing flags. The x-cli-skip endpoints
(site-configs, auth connection exchange) remain excluded.

Tested against the production API:
- browsers create --telemetry=console,network / update --telemetry=page /
  telemetry events / get / delete
- browser-pools create --telemetry=console / get / update --telemetry=network /
  delete
- browsers create --telemetry-cdp-exclude now correctly rejects the removed flag
- read-only sweep: auth context, auth connections list, browsers list,
  browser-pools list, app list, proxies list, profiles list, extensions list,
  org entitlements, telemetry destinations list, credentials list, projects list
- go build ./..., go vet ./..., go test ./... all pass

Triggered by: kernel/kernel-go-sdk@c042837

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>