feat: Harden automatic SSO renewal

[cloudsmith-iduffy]

Summary

• schedule SSO refresh from JWT expiry with clock-skew leeway and retry throttling
• centralize renewal outcomes, refresh-token rotation recovery, and safe keyring persistence
• preserve usable SSO tokens after transient failures while allowing rejected or expired sessions to fall through to other credential providers
• skip automatic renewal for authentication commands and emit precise stderr warnings without bypassing normal API error rendering

Validation

• pytest -q cloudsmith_cli/core/tests/test_sso.py cloudsmith_cli/core/tests/test_keyring.py cloudsmith_cli/core/tests/test_keyring_provider.py cloudsmith_cli/cli/tests/test_decorators.py
• pre-commit run --files CHANGELOG.md cloudsmith_cli/cli/decorators.py cloudsmith_cli/cli/tests/test_decorators.py cloudsmith_cli/core/credentials/models.py cloudsmith_cli/core/credentials/providers/keyring_provider.py cloudsmith_cli/core/keyring.py cloudsmith_cli/core/sso.py cloudsmith_cli/core/tests/test_keyring.py cloudsmith_cli/core/tests/test_keyring_provider.py cloudsmith_cli/core/tests/test_sso.py

Stacked on #406.

[cloudsmith-iduffy]

@copilot resolve all conflicts

[Copilot]

Pull request overview

This PR introduces a more defensive SSO renewal implementation intended to refresh tokens based on JWT expiry (with leeway/throttling) and to better handle refresh-token rotation and transient failures, so the CLI can keep working sessions alive without getting stuck on dead credentials.

Changes:

• Added a new shared renewal flow (renew_sso_session) with structured outcomes and token-expiry decoding.
• Adjusted keyring refresh throttling/ordering to better tolerate partial keyring failures and rotation semantics.
• Added/updated tests and documented the new SSO-refresh behavior in the changelog.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
cloudsmith_cli/core/tests/test_sso.py	Adds tests for renewal outcomes (rotation success, transient failure reuse, rejection cleanup).
cloudsmith_cli/core/tests/test_keyring.py	Extends keyring refresh tests to cover JWT-expiry-driven refresh behavior and token storage ordering.
cloudsmith_cli/core/sso.py	Implements JWT-expiry decoding helpers and a new renewal API (renew_sso_session) with structured status handling.
cloudsmith_cli/core/keyring.py	Updates refresh-throttle persistence behavior and adds JWT-expiry-aware refresh decision logic.
CHANGELOG.md	Documents the new SSO refresh behavior and fallback semantics.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

@copilot resolve all conflicts

Resolved in 7499df7 after merging master and the remote PR tip; the branch is conflict-free again.