refactor(cli): a --token travels as an argument, never through the process environment

[blafourcade]

Problem

aidd plugin install --token and aidd marketplace add --token hand the token to the fetcher by writing AIDD_TOKEN into the process environment, and runtime/auth/auth-reader-adapter.ts and auth-storage.ts read it back from the global. The use case now goes through an Environment port (#795), but the channel is the same ambient variable: a value set in one command is visible to every later read in the process, a test that forgets to reset it leaks into the next, and nothing in the types says the fetcher depends on a flag parsed three layers up.

Scope

• The token a flag carries travels as an argument: the install and marketplace-add use cases receive it in their options and pass it to the auth reader, which prefers an explicit token over its stored ones.
• Environment.set disappears with its only caller; the port keeps get, for the refresh switch.
• presentation/commands/marketplace.ts stops writing process.env.
• AIDD_TOKEN as a user-set variable keeps working, read once by the auth reader.

Acceptance criteria

• grep -rn "process.env.AIDD_TOKEN\|environment.set(" cli/src returns the auth reader's one read and nothing else
• A --token given to plugin install reaches the fetcher on a fetcher built before the flag was parsed (the existing publishes --token … test, rewritten against the argument)
• The environment-port test double loses set and its tests still describe the switch alone
• Every gate green, framework and runtime mutation floors hold

Prior art in this repo

• feat(cli): one shared framework source per machine, user scope and session telemetry #795 routed the read through contexts/framework/domain/ports/environment.ts and left this note in its report: "routed through a port ≠ coupling removed".
• tests/contexts/framework/application/plugin/plugin-install-use-case.unit.test.ts, publishes --token through the environment, for a fetcher built before the flag arrived.

Out of scope

• The twelve presentation/ files and kernel/paths.ts that read process.platform, process.cwd() or process.exit directly. Allowed by the layer rule; a separate decision whether presentation should read them through deps.