cli/cloud: add pulumi insights account scan list and scan get - #23255

Summary

Fixes "no way to discover scan IDs from the CLI."

Two new subcommands fill in the gap between triggering a scan and reading its logs:

• pulumi insights account scan list <account> — recent scans, with IDs.
• pulumi insights account scan get <account> <scan-id> — full workflow run for one scan.

Combined with the existing account scan (trigger) and account scan log (logs), users can now drive the entire create → scan → debug flow without going to the UI.

Analogous to pulumi deployment …

Insights scans and Pulumi Deployments share a server-side workflow handler, so this PR deliberately mirrors the existing deployment command family:

Where they overlap, the new commands copy the deployments-side shape so the two surfaces feel like the same family:

• scan get text view follows deployment get (%-18s key/value alignment, summary fields, Jobs: <count> only — the full per-job/per-step structure lives in --output json).
• scan list follows the --count / --all pagination convention (mutually exclusive; --count 0 is a synonym for --all) established by insights account list.
• Both commands accept the same --org / --output global flags as the rest of the Cloud-Ready CLI surface.

Sample output

account scan list <parent> (spans every child account)

$ pulumi insights account scan list "Michael-Test-AWS" --org pulumi --count 5
┌──────────────────────────────────────┬────────────────────────────┬───────────┬──────────────────────┬──────────┐
│ Scan ID                              │ Account                    │ Status    │ Started              │ Duration │
├──────────────────────────────────────┼────────────────────────────┼───────────┼──────────────────────┼──────────┤
│ 724db660-7363-469a-96dd-50eeddedf08c │ Michael-Test-AWS/us-west-1 │ succeeded │ 2026-01-21T15:58:49Z │ 5m30s    │
│ 7bb80f16-8793-4b7c-bbf8-11e8d81f6ca7 │ Michael-Test-AWS/us-east-2 │ succeeded │ 2026-01-21T15:58:47Z │ 44m29s   │
│ 135a8707-0297-48b0-bdf8-0c460ae837d2 │ Michael-Test-AWS/global    │ succeeded │ 2026-01-21T15:58:44Z │ 2m54s    │
│ b4e5a5d2-b9ad-47ee-bc6e-7ec3fb643345 │ Michael-Test-AWS/us-west-1 │ succeeded │ 2026-01-15T22:17:50Z │ 5m35s    │
│ 33f4591d-6f52-494b-8bc8-22356fac0857 │ Michael-Test-AWS/us-east-2 │ succeeded │ 2026-01-15T22:07:16Z │ 45m16s   │
└──────────────────────────────────────┴────────────────────────────┴───────────┴──────────────────────┴──────────┘

account scan get (default text)

$ pulumi insights account scan get "Michael-Test-AWS/us-east-2" 7bb80f16-… --org pulumi
ID:                7bb80f16-8793-4b7c-bbf8-11e8d81f6ca7
Status:            succeeded
Started:           2026-01-21T15:58:47Z
Finished:          2026-01-21T16:43:16Z
Duration:          44m29s
Last updated:      2026-05-19T00:10:57Z
Jobs:              1

account scan get --output json (full workflow run)

{
  "id": "7bb80f16-…",
  "status": "succeeded",
  "startedAt": "2026-01-21T15:58:47.305Z",
  "finishedAt": "2026-01-21T16:43:16.079Z",
  "jobs": [
    {
      "status": "succeeded",
      "started": "2026-01-21T15:59:15.852Z",
      "timeout": 43200000000000,
      "steps": [
        { "name": "Setup", "status": "succeeded" },
        { "name": "Download scanner", "status": "succeeded" },
        { "name": "Install provider", "status": "succeeded" },
        { "name": "Scan account", "status": "succeeded" }
      ],
      "worker": "i-020f6b242e2452051"
    }
  ]
}

Test plan

• Unit tests: 12 cases for scan list, 7 for scan get (table/JSON rendering, in-flight scans, pagination defaults / --all / --count / --count 0, org+account propagation incl. slash names, factory + client errors, page-loop safety net).
• mise exec -- make format
• mise exec -- make lint (0 issues across 7 packages)
• Live smoke against the pulumi org on Michael-Test-AWS (parent) and Michael-Test-AWS/us-east-2 (leaf), end-to-end scan list → copy ID → scan get <leaf> <id> → scan log <leaf> <id>.

🤖 Generated with Claude Code