fix(chat): prefer Copilot CLI OAuth over a token in the CLI interface

> 🤖 Generated by the Agentic Engineer

Part of #6457. Depends on the mechanism confirmation.

## Problem

`pkg/cli/cmd/open/chat/client.go` already supports both mechanisms but orders them token-first, and
its failure text leads with the token:

```
- Set KSAIL_COPILOT_TOKEN or COPILOT_TOKEN for token-based authentication
```

A user who has run `copilot auth login` is still steered to mint a token they do not need.

## Expected behaviour

Copilot CLI OAuth is attempted **first**. A token is used when explicitly set, and still wins when
present — an override stays an override, so existing setups are unaffected.

The failure message inverts to match: lead with `copilot auth login`, and present the token as the
option for non-interactive environments.

## Acceptance criteria

- With the CLI authenticated and no token set, `ksail open chat` works and never mentions tokens.
- With a token set, behaviour is **unchanged** from today — pin this with a test, since it is the
guardrail the Epic commits to.
- Both states are covered by tests, per the repo's feature-flag-first both-states rule.

Start with pkg/cli/cmd/open/chat/client.go and trace the authentication path used by ksail open chat. Run the command in both states described: an authenticated Copilot CLI without a token, and with a token set. Done means OAuth is preferred without mentioning tokens, while token-based behavior remains unchanged and both states have tests.

Written by the indexing model from the issue text.