bug(cli): explain restart requirements after static provider credential updates #5293

User Story

I need to rotate provider credentials for continuing workloads in OpenShell's native Windows MXC runtime and know when the client must be relaunched. The update command should explain the next action when an existing process retains an ordinary static credential reference.

Problem Statement

On the windows branch, openshell provider update reports persistence and optionally readiness without explaining that ordinary static references held by existing processes continue resolving their original value. Readiness installs the new reference for future processes; --wait does not retarget an already-issued ordinary static reference.

The existing stable_placeholder: true profile option supports live value-only rotation. This issue concerns missing command guidance, not changing the default credential lifecycle.

Impact / Why This Matters

A successful update can leave an operator waiting for a continuing client to switch credentials. Relaunching the client or recreating its sandbox works, but the command does not reveal that requirement. Finding it in separate documentation interrupts the rotation workflow.

A native MXC reproduction with synthetic credentials observed 19 OLD and 0 NEW requests in 20 seconds after an ordinary static update. A recreated sandbox used NEW. With the existing stable-placeholder option enabled before startup, the continuing client switched to NEW within the observation window.

Acceptance Criteria

• Successful human-readable credential updates with attached sandboxes explain that ordinary static references require a fresh client process after readiness, or sandbox recreation for the main process, including with --wait.
• Guidance identifies stable placeholders and gateway-managed refresh as the appropriate live-rotation alternatives without claiming that every credential requires a restart.
• JSON/YAML results and mutation/readiness semantics remain unchanged.
• Updates do not require additional provider-profile read permission.
• Config-only updates and updates with no attached sandboxes omit the rotation reminder.
• Regression tests and the provider documentation cover the behavior.

Reproduction Steps

1. Use an OpenShell gateway with the native MXC runtime and attach an ordinary static provider to a sandbox whose long-running client uses its injected credential reference.
2. Save a new synthetic credential value with openshell provider update <provider> --credential <KEY>.
3. Inspect the default output: it reports the mutation receipt but has no restart or recreation guidance.
4. Wait for readiness with openshell sandbox provider status <sandbox> <provider> --wait --timeout 30 --output json. The continuing client retains its old ordinary static reference.
5. Recreate the workload: the fresh process receives the new reference. As a separate control, enable stable_placeholder: true before workload creation and repeat a value-only update; the continuing client can resolve the new value without a restart.

Suggested UX

After the normal table output, explain that ordinary static credentials retain old references in existing processes, then point to openshell sandbox exec, sandbox recreation, and the stable-placeholder or gateway-managed-refresh options.

Environment

• Source: NVIDIA/OpenShell windows at 5b9e5b91afb10afbce8d9be09e2513a7efc22a21.
• OS: native ARM64 Windows, build 28020.3112.
• Runtime: MXC ProcessContainer with signed native wxc-exec 1.0.0 and the authenticated OpenShell supervisor.
• Credentials: synthetic fixture values only.