Astro CLI 1.47.0 aflaai

Changelog
- bbd31db: APC-1687 Add hibernation and wake commands in APC (#2269) (@sudarshanrampuria)
- 4c7e363: Add an opt-in release channel for the next major version (#2266) (@jlaneve)
- 9fe4410: Build with Go 1.26.10 (#2396) (@schnie)
- 1654086: Bump grpc to 1.83.1 and otel to 1.45.0 (#2277) (@schnie)
- cbf1e32: CLI Release: update godownloader to v1.46.0 (#2267) (@octo-sts[bot])
- fa7ec66: CLI Release: update godownloader to v1.46.1 (#2403) (@octo-sts[bot])
- 0548d6a: Clear the refresh token on logout and stop failing silently (#2218) (@jlaneve)
- 3656251: Constrain template extraction to the destination directory (#2220) (@jlaneve)
- c43f28d: Correct why the client registry advice uses -g (#2348) (@schnie)
- 0b8c2c7: Default the DAG integrity test's exceptions to empty when the file is missing (#2324) (@schnie)
- 55c7bc8: Label PRs that target main (#2372) (@jlaneve)
- ddb9f31: Let the installer take a bare major for that major's newest release (#2275) (@schnie)
- 78cec88: Let the installer take vX.Y and versions without a leading v (#2314) (@schnie)
- bee6243: Log "Using an Astro API Token" at debug level (#2316) (@jeremybeard)
- 715df64: Log out of a domain under the name login stored it as (#2371) (@schnie)
- b5d3310: Mark only a full stable-major release as GitHub's latest (#2370) (@schnie)
- 2558c45: Match the agent's settings namespace, and drop the remote deploy warning (#2351) (@schnie)
- 1371be2: Name the right config in the unconfigured-registry advice, and keep TestClientRegistry from leaking (#2341) (@schnie)
- abc97cd: PINF-703 add token login support to autheticate with token passing (#2157) (@pgvishnuram)
- 86cafee: Pass registry passwords over stdin instead of through a shell string (#2221) (@jlaneve)
- 591992a: README: install on Linux without sudo (#2408) (@schnie)
- 3dc5fa3: Refuse a Remote Execution agent image on astro deploy, and warn when astro remote deploy gets something else (#2226) (@seanmuth)
- 9c94008: Reject embedded image tags in remote.client_registry (#2224) (@seanmuth)
- 87048e4: Remove the plain-text file every connection and variable export leaves behind (#2219) (@jlaneve)
- f7b5b11: Retry rate-limited API requests, and stop when an API token's organization can't be looked up (#2407) (@jeremybeard)
- d060c60: Return an error when the app config lookup fails in deployment create (#2406) (@vjsairam)
- 9bbfcef: Show each API token's kind (STANDARD / DIRECT_ACCESS) in token lists (#2249) (@sakethsomaraju)
- 7a8422d: Show the token KIND column last, so earlier columns keep their positions (#2330) (@schnie)
- 2ea17a2: Stop standalone Airflow's whole process group, sign with a random secret, and warn when it's open to the network (#2222) (@jlaneve)
- c93c83d: Store an ASTRO_API_TOKEN login's real expiry, and only after the token is accepted (#2217) (@jlaneve)
- 1a1ba78: Tell an agent image's user to stop building FROM the agent image (#2349) (@schnie)
- 228ed8d: Unhide the bundle commands and flags (#2264) (@jeremybeard)
- 940c773: chore(ci): add deadcode tooling to catch exported orphan funcs (#2127) (@schnie)
- 0d9fe26: chore(deps): bump certifi from 2024.8.30 to 2026.10.19 in /integration-test (#2410) (@dependabot[bot])
- 4479a08: chore(deps): bump github.com/getkin/kin-openapi from 0.135.0 to 0.144.0 (#2229) (@dependabot[bot])
- 1904191: chore(deps): bump github.com/getkin/kin-openapi from 0.144.0 to 0.149.0 (#2368) (@dependabot[bot])
- 3414ebb: chore(deps): bump github.com/go-git/go-git/v5 from 5.19.1 to 5.19.2 (#2240) (@dependabot[bot])
- 3801572: chore(deps): bump github.com/klauspost/compress from 1.18.6 to 1.18.7 (#2402) (@dependabot[bot])
- 7aa23cd: chore(deps): bump github.com/moby/sys/user from 0.4.0 to 0.4.1 (#2279) (@dependabot[bot])
- 1dc75a7: chore(deps): bump github.com/oapi-codegen/oapi-codegen/v2 from 2.4.0 to 2.7.1 (#2211) (@dependabot[bot])
- 38d4c9c: chore(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 (#2278) (@dependabot[bot])
- 492babf: feat: match a customer-configured manifest filename (#2265) (@pankajastro)
- e74f841: fix(deploy): exit non-zero if uncommitted changes are present (#2004) (@sakethsomaraju)
- a7e027c: fix(otto): preflight org membership before launching Otto (AI-992) (#2208) (@akshayarora)