feat(providers): support CLI label creation, inspection, and filtering #4312

User Story

When using OpenShell labels to organize resources, I need providers to support the same create-time labels, inspection, and filtered CLI listing as sandboxes and workspaces.

Problem Statement

Provider metadata already persists labels, but provider creation in the CLI always sends an empty label map. Provider list requests do not accept selectors, and the human-readable get output omits labels.

Impact / Why This Matters

Organizing providers by team or environment requires API-level creation and client-side filtering. The standard CLI workflow available for other OpenShell objects is missing.

Proposed Design

Support repeated --label KEY=VALUE flags on provider creation, --label-selector key=value,key2=value2 on provider listing, and labels in provider get output. Filter at the gateway before pagination for named and all-workspaces scopes. Preserve authorization and secret redaction. Keep existing update behavior unchanged.

Suggested UX

openshell provider create --name public-pypi --type pypi --label env=dev --label team=ml
openshell provider list --label-selector env=dev,team=ml
openshell provider list --all-workspaces --label-selector team=ml --output json
openshell provider get public-pypi

Acceptance Criteria

• Create labels work with all existing credential sources and malformed labels are rejected.
• List selectors match all requested pairs before pagination and respect workspace authorization.
• Pagination tokens reject selector changes; malformed selectors are rejected.
• Provider get shows labels; JSON/YAML output and credential redaction remain correct.
• Focused tests, docs, and related CLI skill guidance cover the new workflow.
• No label update or individual label removal feature is added.

Alternatives Considered

API creation and client-side filtering require users to bypass the CLI and manually handle pagination. Middleware and interceptors cannot add CLI flags or a public list request field. Reusing the gateway's existing label storage and selector pager provides the same workflow as other objects.