feat(aigateway): config + workspace list/get (read-only) + doctor reachability

[cdot65]

Summary

Slice 2 of #299: first AI Gateway surface. Adds PANW_AI_GW_* config fields, an SdkAiGatewayService wrapper over the SDK AIGatewayClient, read-only airs aigateway workspace list|get commands, and an AI Gateway reachability check in airs doctor.

Stacked on #305 (SDK pin bump) — merge that first; this branch includes its commit.

Changes

• src/config/{schema,loader,client-options}.ts — aiGwDataEndpoint/aiGwAdminEndpoint/aiGwTokenEndpoint (+ mgmt token fallback), aiGatewayClientOptions()
• src/airs/aigateway.ts — workspace list/get normalization (snake→camel, is_default→bool, limits union→array), listAllWorkspaces() merging admin active+archived, aiGatewayGrantHint() for 403 AB03 vs tenant-root diagnosis
• src/cli/commands/aigateway.ts + renderer — --plane, --status, --all, flag-canon --output; null status renders unknown; data-plane hint that a bare list is not "all workspaces"
• airs doctor — 7th check: AI Gateway reachability via cheapest data-plane read, grant hint on 403
• Docs page docs-site/docs/cli/aigateway/workspaces.md, .env.example, CLAUDE.md; changeset (minor)

Testing

• TDD: failing specs committed first (wrapper, renderer, config, doctor)
• 892 tests green (25 new); tsc + Biome clean; docs build clean
• Live-verified gotchas from the handoff encoded in tests (plane/status hiding, --all merge, null status, limits union, 403 hints)

Closes #301