fix: adopt low-risk CLI product diagnostics

[vibeforge1111]

Summary

• Adopt low-risk Spark CLI product fixes after chore: update R24 module registry pins #753 landed on master.
• Keep security revoke-all best-effort module resolution resilient when module loading exits via SystemExit.
• Add bounded timeouts and traceback-free timeout messages for editable pip installs used by Graphiti/Kuzu sidecar and browser-use setup.
• Improve unknown install target diagnostics with installed modules, registry-known modules, and accepted target forms.
• Improve Spark Doctor provider fallback diagnostics with the directly callable provider set and recovery commands.

Source credit

Maintainer-owned adoption inspired by source PRs:

• [spark-compete] fix(security): keep revoke-all best-effort when a module manifest is broken #751 by @banse: revoke-all best effort on broken module manifest.
• fix(lens3): add timeout to pip install subprocess calls #744 by @ifeoluwaaj: pip install timeout.
• [spark-compete] fix(cli): name installed + registry modules in 'Unknown module target' install error #737 by @4gjnbzb4zf-sudo: unknown module target diagnostics.
• [spark-compete] fix(cli): name supported providers in call_llm_doctor fallback error #736 by @4gjnbzb4zf-sudo: supported providers in doctor fallback.

Inspected but deferred

• [spark-compete] fix(setup): restart a running agent so re-setup applies new provider/model config #713 by @banse: setup restart of running agent to apply config. Deferred for this lane because it changes setup/start behavior into restart behavior and could affect live agent lifecycle semantics more broadly than these low/medium diagnostics/install fixes.

Not included

• [spark-compete] fix(secrets): Add confirmation prompt for secrets get --reveal [LENS-4] #741, [spark-compete] fix(lens1): semicolon bypass in split_single_argv_command #743, [spark-compete] fix: set restrictive permissions on generated .env files #693 per lane constraints.

Tests

• PYTHONPATH=src python -m pytest tests/test_cli.py -q -k "best_effort_survives_broken_manifest or unknown_message or sidecar_dependencies or call_llm_doctor_unsupported_provider or browser_use_install_reports_package_install" (11 passed, 652 deselected)
• PYTHONPATH=src python -m compileall src tests
• git diff --check

Registry / provenance

• Not run: this PR only changes CLI behavior and CLI tests; no registry, provenance, installer manifest, or pin files changed.