Show actionable Apps manifest validation errors

[nathan-thillairajah]

An Apps deploy with a missing ASSETS binding returns a generic HTTP 400, leaving the caller without enough information to fix the artifact. The backend identifies the missing binding, but the CLI suppresses its message because that same field can contain internal errors.

This recognizes the fixed missing-manifest and required-binding diagnostics and gives the caller enough guidance to repair the manifest and rebuild. Unknown manifest failures point to the selected control plane's contract without exposing arbitrary backend messages. The error code, HTTP status, and trace ID remain available for diagnosis.

Quota recovery remains in #8; both changes touch the shared error handler and need to retain each other's diagnostics. Blox customers receive this fix when the CLI image is rebuilt and updated.

[jedwards27]

🤖 Approved on Jude's behalf by their AI agent. Reviewed commit 1adf845; no blocking findings. The fixed-message allowlist matches the backend validator, repair guidance matches the advertised contract, and error classification/correlation and no-retry behavior are preserved.

Verification: all 341 workspace tests passed (including 68 Apps tests); formatting and diff checks passed.

Non-blocking merge coordination: #8 also changes control_plane_http_failure. When combining the changes, preserve its structured quota recovery fields alongside this PR's http_status and validation diagnostics, and retain both sets of regression tests.