Record the CLI version that pushed a configuration

[ChristianPavilonis]

Problem

ts config push publishes the operator configuration, but the stored configuration does not identify which Trusted Server CLI version created the push. That makes it difficult to diagnose differences in serialization, validation, or behavior after a CLI upgrade or when multiple operator environments use different versions.

Proposed outcome

Add push-provenance metadata that records the Trusted Server CLI version used to publish a configuration. On a later ts config push, if the stored configuration was last published by a different CLI version, surface that fact clearly before or as part of the push result.

Considerations

• Define a stable, forward-compatible metadata location in the pushed configuration envelope rather than the operator-authored configuration body.
• Preserve compatibility with configurations that were pushed before the metadata existed.
• Decide whether a version mismatch is informational, requires explicit confirmation, or can be elevated to a warning/error in non-interactive contexts.
• Make the output actionable: show both the existing stored version (when available) and the running CLI version.
• Add coverage for initial pushes, same-version updates, different-version updates, and legacy configurations with no recorded version.

Acceptance criteria

• A newly pushed configuration records the version of the CLI that pushed it.
• Re-pushing a configuration from a different CLI version visibly calls out the version change.
• Existing configurations without provenance remain usable and can be updated successfully.
• User-facing CLI documentation/help and tests describe and cover the behavior.