Reject launch source flags under managed config

[andy-xu-db]

🥞 Stacked PR

Use this link to review incremental changes.

• auto-claude-model-discovery [Files changed]
  • stack/andy/managed-config-cli-guard [Files changed] ← this PR
    • stack/andy/managed-config-claude-discovery [Files changed]
      • stack/andy/managed-config-codex-discovery [Files changed]

---

Summary

• Reject explicit --provider and --model-location launch options whenever the workspace returns a managed config, including an empty config.
• Keep the existing first-launch/bootstrap path unchanged.
• Keep saved provider choices valid; only explicit command-line source flags are rejected.

Stack

Built directly on #710. Claude behavior is isolated in #715 and Codex behavior in #716.

Testing

• uv run pytest -q --ignore=tests/test_e2e_user_agent.py: 2,406 passed, 41 skipped at the stack tip
• uv run pytest tests/test_cli.py -q: 369 passed on this branch
• Ruff check and format check pass for all changed Python files
• git diff --check

[lilly-luo]

this diff looks pretty extensive to do validation. would you be able to simplify some of the refactors + clean up the tests