CLI UX: Improve error message when Axon controller is not installed

Problem

When a user tries to use axon get, axon run, or other commands before running axon install, they get a cryptic Kubernetes RBAC error:

Error: listing tasks: tasks.axon.io is forbidden: User "system:serviceaccount:default:default" cannot list resource "tasks" in API group "axon.io" in the namespace "default"

For new users following the Quick Start, this error provides no actionable guidance about what to do next.

Current Experience

A new user might:

1. Install the CLI: go install github.com/axon-core/axon/cmd/axon@latest
2. Run axon init and configure their token
3. Try to run a task: axon run -p "test"
4. Get the cryptic RBAC error
5. Not realize they need to run axon install first

Expected Experience

The error should be user-friendly and actionable:

Error: Axon controller is not installed in the cluster

To install Axon, run:
  axon install

For more information: https://github.com/axon-core/axon#quick-start

Technical Approach

The CLI could detect this scenario by:

1. Checking if the CRDs exist (tasks.axon.io, etc.)
2. If CRDs don't exist, provide a helpful error message
3. This check could be done before attempting the operation

Alternatively, catch the specific RBAC error pattern and provide a more helpful message when it matches "tasks.axon.io is forbidden" or "no matches for kind".

Impact

This will:

• Reduce confusion for new users
• Make the onboarding flow more intuitive
• Provide actionable next steps instead of cryptic errors
• Reduce support burden

Related Issues

This complements the Quick Start documentation improvements but requires a code change rather than just documentation.

Start by locating the CLI entry points for axon get, axon run, and related commands, then inspect how Kubernetes errors are currently surfaced. Compare the CRD-check and RBAC-error approaches described in the issue, and consider how the existing Quick Start flow is represented. Done means users receive actionable installation guidance instead of the cryptic RBAC or missing-kind error.