feat(cli): add projects support with --project flag and name resolution

[hiroTamada]

Summary

• Adds a global --project persistent flag (and KERNEL_PROJECT_ID env var) that injects the X-Kernel-Project-Id header to scope all API requests to a specific project
• The flag accepts either a project ID or a project name — names are resolved via the projects list endpoint with case-insensitive matching
• Adds kernel projects subcommands: list, create, get, delete, get-limits, set-limits
• Upgrades kernel-go-sdk to v0.48.0 for project endpoint support (also fixes ProxyService.Check signature change)

How it works

When --project is provided:

1. If the value looks like a cuid2 ID (24 lowercase alphanumeric chars), it's used directly as the project ID header
2. Otherwise, the CLI authenticates first, calls GET /projects to list all projects, finds a case-insensitive name match, and injects the resolved ID
3. Clear errors for: no match found, multiple matches (ambiguous name)

Test plan

Tested against staging with a project-scoped API key:

• --project "cli-test-project" (by name) — resolves correctly
• --project "CLI-TEST-PROJECT" (case-insensitive) — resolves correctly
• --project "g9vcya6unur84k70n0u8s9p9" (by ID) — works directly
• --project "nonexistent-project" — clear error message
• KERNEL_PROJECT_ID="cli-test-project" env var with name — resolves correctly
• No --project with scoped API key — auto-scopes via server middleware
• kernel projects list/create/get/delete/get-limits/set-limits — all functional

Made with Cursor

---

Note

Medium Risk
Adds a new global --project/KERNEL_PROJECT_ID request-scoping mechanism and project-name resolution in the auth/bootstrap path, which can affect all API calls if mis-resolved. Also upgrades the Kernel SDK and adjusts proxy check calls/signatures to match the new API.

Overview
Adds a new top-level projects command with subcommands to list, create, get, delete, and manage limit overrides (get-limits/set-limits).

Introduces a global persistent --project flag (or KERNEL_PROJECT_ID) that scopes all authenticated requests via the X-Kernel-Project-Id header, including case-insensitive project name resolution when a non-CUID value is provided.

Updates CUID detection to require a leading letter, upgrades github.com/kernel/kernel-go-sdk to v0.48.0, and adapts proxy health check calls/tests to the SDK’s updated Check signature.

^{Reviewed by Cursor Bugbot for commit 8d3fa6a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[firetiger-agent]

Firetiger deploy monitoring skipped

This PR didn't match the auto-monitor filter configured on your GitHub connection:

Any PR that changes the kernel API. Monitor changes to API endpoints (packages/api/cmd/api/) and Temporal workflows (packages/api/lib/temporal) in the kernel repo

Reason: PR modifies CLI functionality (packages/cli) and SDK dependencies, not kernel API endpoints (packages/api/cmd/api/) or Temporal workflows (packages/api/lib/temporal).

To monitor this PR anyway, reply with @firetiger monitor this.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit e55a6c3. Configure here.}