Auth

The CLI's runner session is what lets it resolve the operator's credentials and run scripts/bash on their behalf. Three commands manage that session:

• geni login, one-time browser auth that mints a runner session.
• geni auth status, inspect the active session.
• geni logout, revoke and remove it.

The runner session is scoped to credential resolution and execution. It can run shell commands with the operator's credentials injected as env vars; it cannot create or edit anything in the operator's account.