[EPIC cloudctl] - Migrate internal tooling from u8s to cloudctl #70

Description

u8s is an internal SAP CLI that bundles kubectl, helm, kubelogin, and other utilities with version-pinned downloads, OIDC logon, context management, and fleet-wide operations. As cloudctl becomes the public OSS successor, the relevant functionality should be migrated so external users get the same experience without needing the internal tool.

Objectives

• Port the tool download infrastructure (kubectl, helm, kubelogin) with SHA-256 verification and XDG cache management
• Add kubectl and helm subcommands that auto-inject context/namespace/kubeconfig
• Add OIDC logon subcommand backed by version-pinned kubelogin
• Add foreach for fleet-wide parallel kubectl execution with context selectors
• Add doctor, set/env, and prompt for local state management and shell integration

Acceptance Criteria

• Tool download infrastructure ported with checksum verification and progress output
• cloudctl kubectl downloads version-matched kubectl and execs with injected flags
• cloudctl helm downloads pinned helm and execs with injected flags
• cloudctl logon detects auth type and invokes kubelogin appropriately
• cloudctl foreach runs kubectl in parallel across selected contexts
• cloudctl doctor resets local cache and config state
• cloudctl set / cloudctl env persist and print session config
• cloudctl prompt prints colored context/namespace for shell prompt integration

Dependencies

• Existing cluster-version command (used by kubectl subcommand to select correct binary version)
• Existing sync command (invoked before kubectl/helm execution)