Add staged connection diagnosis for opaque dial failures

[rossnelson]

Related issues

Related to #224 and #851.

What changed?

This PR turns opaque connection failures into bounded, evidence-based guidance so that users can act on a real cause.

Before this change, a failed server connection could end as an opaque dial error. After the real failure, the CLI performs bounded DNS, TCP, and TLS checks. It offers advice only when the evidence supports it. A generic TLS handshake failure is not proof of mTLS, so it produces no certificate advice. Diagnosis stops after three seconds or when the command is canceled. Set TEMPORAL_CLI_DISABLE_CONNECT_DIAGNOSIS to disable it.

Generated command RunE functions return wrapped errors. A single parent terminal writer sends built-in failures to stderr. Concrete adapters handle connection errors and standalone Activity NotFound errors. Extensions keep their own streams and exit status.

Checklist

Stability

• Breaking changes are marked with 💥 in the PR title and release notes
• Changes to JSON output (-o json / -o jsonl) are treated as breaking changes

Design

• This feature does not depend on Cloud-only APIs or behavior (it works against an OSS server)
• New commands follow temporal <noun> <verb> structure (e.g. temporal workflow start)
• New flags are named after the API concept, not the implementation mechanism (good: --search-attribute, bad: --index-field)
• New flags don't duplicate an existing flag that serves the same purpose
• New flags do not have short aliases without strong justification
• Experimental features are marked with (Experimental) in commands.yaml

Help text (see style guide at the top of commands.yaml)

• All flags shown in help text and examples are implemented and functional
• Summaries use sentence case and have no trailing period
• Long descriptions end with a period and include at least one example invocation
• Examples use long flags (--namespace, not -n), one flag per line
• Placeholder values use YourXxx form (YourWorkflowId, YourNamespace)

Behavior

• Results go to stdout; errors and warnings go to stderr
• Error messages are lowercase with no trailing punctuation

Tests

• Added functional test(s) (SharedServerSuite)
• Added unit test(s) (func TestXxx) where applicable

Manual tests

Setup

No manual setup was used.

Happy path

No manual happy-path run was used. The full test suite passed:

go test ./... -count=1 -timeout=10m

Error case

Focused go test -race terminal and output tests passed. The full race suite was not run.

Composition

No manual composition test was used.

What to look at first

• Whether post-failure DNS, TCP, and TLS checks stay within three seconds, honor cancellation, and avoid unsupported advice.
• Whether one parent terminal path preserves wrapped command errors, stderr output, and extension-owned streams and exit status.
• Whether the deliberately narrow internal scope is appropriate before using this pattern for unrelated CLI errors.

[CLAassistant]

All committers have signed the CLA.