Add app inspection commands to bb apps

[nathan-thillairajah]

Summary

After deploy, readiness, and debugging, the CLI still had no way to discover manageable apps or inspect version history. This adds the read-only inspection commands needed before lifecycle changes such as rollback:

• bb apps list [--scope manageable|owned|publisher] [--include-deleted]
• bb apps get <APP_ID> [--environment <ENVIRONMENT>]
• bb apps versions <APP_ID> [--environment <ENVIRONMENT>]

Each command maps directly to the current Compose agent endpoint, uses the existing allowlisted control-plane client, safely encodes app IDs and query values, and preserves the server JSON. Omitted filters and environments stay omitted so the control plane owns its defaults.

Related issue

N/A. No matching open issue or PR found.

Testing

At commit 290d9511fc7d629bacc4869e4f5813f3314791dc:

• cd bb-cli && source ../bin/activate-hermit && just check (141 unit, 74 bb E2E, 22 CLI E2E, and 6 acceptance tests)
• repository pre-commit and pre-push hooks (frontend checks, Tauri checks, formatting, and Clippy)

Live control-plane verification was not run because the local Builderlab CLI session is intentionally logged out. Routes, filters, environment selection, and response behavior were verified against the current squareup/blockplat-compose handlers, README, and staging smoke, with mocked process coverage in Berd.

[morgmart]

🤖 Automated code review

APPROVE. Fresh static review of the exact three-dot comparison 8e7e350...290d951 found no publishable findings. The new list, get, and versions CLI flows consistently build authenticated GET requests, encode app IDs and query values, preserve control-plane JSON responses, and are covered by discriminating request-shape and process-level tests. Final self-check covered every changed user flow; accessibility; i18n/localization completeness; navigation and consent guards; async, error, never-completes, lifecycle, and race behavior; test honesty; design-system and project rules; duplicate overlap; and blocking-severity evidence plus user effect. The change is CLI-only, introduces no applicable UI accessibility, localization, navigation, consent, or design-system regression, and adds no new asynchronous lifecycle mechanism. Supplied GitHub evidence was inspected: all 10 check runs for the exact head SHA completed successfully. Required checks still independently govern merge readiness.

Deterministic publication result: 0 blocking and 0 non-blocking finding(s) publishable; 0 duplicate(s) suppressed.

Pending checks: 1 check(s) are not complete.

This approval reflects the completed code review only; merge readiness remains governed by the repository's required checks.

[morgmart]

🤖 Automated code review

APPROVE. The completed four-lens static review covered the exact three-dot comparison 8e7e350...290d951. Re-checking that boundary and the supplied allowed-anchor array confirmed the PR changes only bb-cli/src/bb/apps.rs and bb-cli/tests/bb_e2e.rs. No publishable findings, duplicate suppressions, or escalations remain. Atlas found a coherent inspection workflow; Vogue found no visual or design-system regression; Spar found the commands reuse the existing control-plane boundary; Engineering found request construction, authentication, encoding, response handling, and tests sound. The supplied GitHub evidence was inspected and all 10 checks for the exact head SHA completed successfully; required checks still independently govern merge readiness.

Deterministic publication result: 0 blocking and 0 non-blocking finding(s) publishable; 0 duplicate(s) suppressed.

Pending checks: 1 check(s) are not complete.

This approval reflects the completed code review only; merge readiness remains governed by the repository's required checks.