CX-56116 extend infra command

[liviu-ilea]

What this does

Brings cx infra resources up to date with the infrastructure API.

New API surface (CX-56116)

• list rows now carry health_policies, so you can see which policy made a resource critical.
• health-history takes several resource ids in one call. It moved to POST /v1/health-history; the old per-id GET is deprecated server side.
• raw-data takes --timestamp to read a configuration as it stood in the past, and reports which version it returned.
• Two new commands: config-changes (which resources changed) and config-diff (what changed, field by field).

The cx-infra skill is updated for all of it, and rewritten to be shorter: about 1,140 words, down from 1,830 on master. It drops what --help already shows and keeps what an agent can't learn from the CLI (API behaviour, output shapes, outcomes).

Breaking changes

These apply to -o json and -o toon alike, since both encode the same rows.

raw-data now wraps the document instead of printing it bare. Read .raw_data where you read the top level before. Text output gains a version: line above the document.

// before                                   // now
{"host_id": "i-abc", "tags": {...}}         {"version_timestamp": "2026-09-03T13:26:58Z", "raw_data": {"host_id": "i-abc", "tags": {...}}}

health-history now has one entry per resource, with its samples nested under it. The text table gains a leading Resource column.

// before                                   // now
[{"timestamp": "...", "status": "Healthy"}] [{"resource_id": "1001234:host_id=i-abc", "health_history": [{"timestamp": "...", "status": "Healthy"}]}]

A resource with no samples is still listed, with an empty health_history. In text output it shows as a row of dashes.

Worth knowing

• health-history, config-changes and config-diff accept at most 100 resource ids. The API silently drops the rest, so the CLI refuses the call instead of returning a partial answer.
• --timestamp is nanosecond precision, because the configuration history is keyed to the nanosecond.

Testing

Unit, integration and e2e tests cover every new command and flag. Full suite passes (1319 tests).

[CLAassistant]

All committers have signed the CLA.