fix(cli): skip saved session lookup for machine auth

[nikhilmaddirala]

Summary

The root command checked the saved user session before detecting a supplied machine token or explicit Universal Auth login credentials. That made commands that do not need a saved session read the platform credential store.

This change skips that lookup for:

• supplied service or machine tokens, including INFISICAL_TOKEN
• login --method universal-auth with explicit client credentials from flags or environment variables
• --silent invocations, where the optional warning is suppressed

The optional saved-session overwrite warning is intentionally skipped for these
machine-authenticated paths. Showing it would require reading the platform
credential store, even though the command does not need a saved user session.
Non-machine, non-silent commands retain the existing root pre-run lookup.

Validation

• nix shell nixpkgs#go --command go test -vet=off ./packages/cmd -run 'Test(ShouldReadSavedSession|HasExplicitUniversalAuthCredentials|RootPersistentPreRunSavedSessionLookup)$' -count=1
• nix shell nixpkgs#go --command go test -vet=off ./packages/cmd -count=1
• nix shell nixpkgs#go --command go build -o /tmp/infisical-cli-session-check .
• git diff --check

The hook-level test invokes the root PersistentPreRun with INFISICAL_TOKEN, Universal Auth flags, and Universal Auth environment credentials. It uses an injected saved-session lookup and asserts those paths never call it, without accessing Secret Service, Keychain, or any other platform credential store.

With the locally available Go 1.26.7, the same package test without -vet=off stops on existing zerolog.Event.Msgf non-constant-format diagnostics in packages/cmd/run.go, before the new tests run.

Agent Attribution

• Agent slug: codex-gpt-5-developer
• Harness: codex
• Model: gpt-5
• Persona: developer
• Host: vermax
• Worktree: /home/nikhilmaddirala/.codex/worktrees/infisical-cli-token-bypass
• Commit identity mode: author-only
• Human operator: nikhilmaddirala

[infisical-cla-app]

📝 Contributor License Agreement required

Before this PR can merge, every contributor must sign the Infisical CLA.
Signing is quick: sign in with GitHub, review the CLA, and accept.

👉 Sign the CLA

Commits from unrecognized email addresses (not linked to a GitHub account):

• agent+codex-gpt-5-developer@nikhilmaddirala.com

Please link this email to your GitHub account and push again, or sign with the account that owns it.

Once everyone has signed, the check updates automatically — no need to close and reopen the PR.