[P3.3] Remove dead CLI helpers and de-duplicate the triplicated provider-key validation

[frankbria]

Filed by the SaaS launch review. Priority P3.3 — severity low, category dead-code.

Problem

The CLI is the product's primary surface, so its source is the most-read code in the repo. helpers.py's two public functions (require_auth, format_date) have no importer, codeframe/cli/commands/ is an empty placeholder package that looks like an in-progress refactor, .env/API-key loading is duplicated three times in validators.py on top of app.py's import-time load, and the engine/provider key-validation block is copy-pasted across three commands so any future change to key handling gets applied to two of three sites. cf work batch run --help also advertises --isolation worktree, which the batch command unconditionally rejects.

Evidence

• codeframe/cli/helpers.py:21
• codeframe/cli/commands/__init__.py:1
• codeframe/cli/validators.py:13
• codeframe/cli/app.py:2531
• codeframe/cli/app.py:3797

Acceptance criteria

• helpers.py contains only functions with a caller; codeframe/cli/commands/ removed
• Provider/engine key validation extracted to one helper used by cf work start, cf work batch run and cf tasks generate, all rejecting a missing key with the same message
• cf work batch run --help no longer offers worktree, or batch accepts it
• uv run pytest tests/cli/ && uv run ruff check . passes

Dependencies

• blocked by [P0.10] Stop a repository .env from overriding the operator's environment #904 (P0.10)

---

Atomic by construction: one developer, one focused session.