Integrate SSO renewal with credential resolution

[cloudsmith-iduffy]

Summary

• integrate the core SSO renewal result API into keyring credential resolution
• retain usable SSO tokens on transient renewal failures while rejecting dead sessions and continuing the provider chain
• skip automatic renewal for authentication commands and emit precise fallback warnings without introducing early CLI errors

Testing

• pytest -q cloudsmith_cli/core/tests/test_keyring_provider.py cloudsmith_cli/cli/tests/test_decorators.py
• pre-commit run --files cloudsmith_cli/core/credentials/models.py cloudsmith_cli/core/credentials/providers/keyring_provider.py cloudsmith_cli/cli/decorators.py cloudsmith_cli/core/tests/test_keyring_provider.py cloudsmith_cli/cli/tests/test_decorators.py

Stacked on #407.