feat(application): add --share-token to run commands - #688

…DK-145)

Recipients holding a share token secret can now describe a run without
OAuth login by passing --share-token <secret> to `application run describe`.
The token is used directly as the Bearer token for platform API requests.

- Adds `--share-token` option to `run describe`; when set, creates a
  `Client(token_provider=…)` bypassing OAuth, with `hide_platform_queue_position=True`
- Catches `UnauthorizedException` and `ForbiddenException` when using a share
  token and surfaces a clear "Access denied" message with exit code 1
- Adds 5 integration tests covering success (text + JSON), not-found,
  unauthorized, and forbidden paths

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Resolve conflict in application/_cli.py: keep both the --share-token
option (this branch) and the --show-checksum option (main) on the
run dump-metadata and dump-item-metadata commands. The command bodies
already reference both parameters; only the signatures collided.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Adds a --share-token option to `application run describe / dump-metadata /
dump-item-metadata / result download` (PYSDK-145), granting an authenticated
user access to a run that has been shared with them.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Address code-review findings on PR #688:
- Fix two _service.py docstrings that wrongly described share-token access as
  "without OAuth"/"unauthenticated"; share tokens elevate an already
  OAuth-authenticated user's access.
- Rewrite the three forbidden CLI tests to raise ForbiddenException from the
  real source (run.details()/run.results()) instead of application_run, which
  wraps all exceptions into RuntimeError in production.
- Normalize an empty --share-token to None at the application_run choke point
  so a blank value falls back to the normal authenticated read; add service
  tests for both branches.
- Make share_token_access_denied_message a pure builder and move the warning
  log to the four CLI call sites (command-query separation).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>