feat(cli): port burn-in/smoke/validate/creds to Python (Phase C1-C6)

Add four native command groups so the Linux host no longer needs pwsh for
manual ops. __main__ registers all four at once, so they ship together.

- bench run     (C2): N concurrent jobs in-process via concurrent.futures,
                      per-round orphan-clone + stale-lock assertions. Replaces
                      Test-CapacityBurnIn.ps1 + Start-BurnInTest*.ps1. No
                      Start-Job/pwsh/$IsWindows.
- bench measure (C3): clone/start/IP/transport/destroy timings appended to
                      benchmark.jsonl (legacy field names kept). Replaces
                      Measure-CIBenchmark.ps1.
- smoke run     (C4): one E2E job; asserts exit 0 + artifact dir + job/success
                      event. ns7zip/nsinnounp presets. Replaces Test-Smoke.ps1
                      + Test-*Build-Linux.ps1.
- validate host (C5): vmrun/snapshot/keyring/permissions/systemd checks.
- validate guest(C6): transport probe with explicit failure cause.
- creds set     (C6): keyring writer matching credentials.py read scheme;
                      password via stdin/prompt only. Replaces
                      Set-CIGuestCredential.ps1.

All groups import backends.load_backend only (Phase D ESXi path stays open).
Suite green, coverage 95.10% (gate 90%); new modules at 100%.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/ci_orchestrator/__main__.py

@@ -13,12 +13,16 @@ import click
 
 from ci_orchestrator import __version__
 from ci_orchestrator.commands.artifacts import artifacts
+from ci_orchestrator.commands.bench import bench
 from ci_orchestrator.commands.build import build
+from ci_orchestrator.commands.creds import creds
 from ci_orchestrator.commands.job import job
 from ci_orchestrator.commands.monitor import monitor
 from ci_orchestrator.commands.report import report
 from ci_orchestrator.commands.retention import retention
+from ci_orchestrator.commands.smoke import smoke
 from ci_orchestrator.commands.template import template
+from ci_orchestrator.commands.validate import validate
 from ci_orchestrator.commands.vm import vm
 
 # Re-export so legacy A1 tests that patched ``cli_module.<name>`` keep working.
@@ -46,6 +50,10 @@ cli.add_command(report)
 cli.add_command(retention)
 cli.add_command(template)
 cli.add_command(job)
+cli.add_command(bench)
+cli.add_command(smoke)
+cli.add_command(validate)
+cli.add_command(creds)
 
 
 if __name__ == "__main__":  # pragma: no cover