fix(cli): resolve optional-extra install commands and preserve extras on upgrade

[Jason Robert (jrob5756)]

Closes#441

The problem

Every hint pointing at an optional extra hardcoded pip install 'conductor-cli[<extra>]'. That cannot work on the documented install path: install.sh / install.ps1 run uv tool install, and a uv tool venv is not pip-managed — plus conductor-cli is not published to PyPI, so pip has nothing to resolve against there.

Two related defects, both included here at Jason Robert (@jrob5756)'s request:

1. aca had the same dead string (and so did claude-agent-sdk) — these were reachable as ProviderError.suggestion, not just docstrings.
2. conductor update silently uninstalled your extras.uv tool install --force replaces the tool's entire requirement set, and the install scripts passed a bare git source, so upgrading dropped [tui] / [aca] without saying anything.

What this does

New conductor.install_hint — a stdlib-only leaf module (top-level, because providers/ needs it and must not import from cli/). Resolves the command from the detected install context:

Signal	Command
<prefix>/uv-receipt.toml	uv tool install --force '<spec>'
direct_url.json with dir_info.editable	uv sync --inexact --extra <extra>
neither	<sys.executable> -m pip install '<spec>'

Four properties are load-bearing:

• Extras already installed are carried forward.--force rewrites the requirement set and uv sync is exact unless given --inexact, so a command naming only the requested extra uninstalls the others.
• The recorded install source is reused (the receipt's git/directory/url, else direct_url.json), so the hint never redirects a fork or a local build at upstream's released tag.
• The pip fallback names this interpreter. A bare pip does not manage a pipx venv — there it succeeds, installing a second copy the user never runs while conductor fleet keeps printing the same error.
• An unreadable receipt is not a bare install. Both look like "no extras", but rendering the first as the second produces a confident command that deletes the user's TUI.

Both install scripts read the same receipt and rebuild the source as conductor-cli[<extras>] @ <source>, so conductor update preserves extras. New --extras <a,b> / --no-preserve-extras (plus CONDUCTOR_INSTALL_EXTRAS / CONDUCTOR_INSTALL_NO_PRESERVE_EXTRAS).

Bugs found and fixed during review

• --no-preserve-extras was a silent no-op on an up-to-date install — the gate compared against a variable the flag itself zeroed, so the shortcut fired and reported success.
• PowerShell handed uv three arguments instead of one — Start-Process -ArgumentList joins elements with spaces and does not quote them, so conductor-cli[tui] @ <src> split apart and the extras were dropped. Verified broken, and fixed, against real pwsh.
• uv exits 0 with only a warning for an unknown extra — a typo installed nothing under two green checkmarks. Extras are now validated up front and the warning is surfaced on the success path.
• installed_extras() could raise despite documenting "never raises" — from inside a ProviderError(...) argument, which deleted the diagnosis rather than degrading the hint.
• Plus: uv sync --extra being exact by default, PEP 503 name normalization, whole-field name = matching (so conductor-cli-plugin is not folded in), and case normalization so the two installers agree.

Verification

• make check clean; 7150 passed / 62 skipped.
• Every fix has a test that fails when reverted — mutation-checked the argv routing, the receipt readability guard, the artifact guard, the wrapped-receipt flatten, the --apply ordering, and the up-to-date gate.
• Three real sandboxed uv tool install runs confirm preserve / add / drop end-to-end.
• install.sh helpers are executed for real; install.ps1 helpers are extracted with PowerShell's own AST parser and executed under pwsh, with a parity class feeding both the same receipt, and a shared oracle asserting the shell and Python parsers agree.

Known gaps

• Format-ProcessArgument does not escape a trailing backslash in a path — unreachable today, since the only such argument is Join-Path $tmpDir 'constraints.txt'.
• No install_scripts-marked Windows test drives install.ps1 with extras end-to-end; AST-level helper tests and a static call-site check cover it short of a real Windows install.