Clarify product store-state access after API rejection

[joshdholtz]

What changed

• Remove the outdated experimental label from product store-state plans in the CLI README.
• Keep store-state commands available to OAuth and API-key credentials. When the API returns its specific store-state feature-gate 403 for an API key, show a next-step hint. Successful API-key requests need no CLI update when the server enables access.
• Document the access decision in the command-surface design notes.

Verification

• make check (go vet, race tests, dependency check)
• Added coverage for API-key success, gated keys, unrelated authorization errors, OAuth, and the agent JSON error envelope.

Review follow-up

• Addressed Bugbot's credential-override finding: the hint now explains how to remove --api-key and RC_API_KEY before retrying with OAuth, including when both are set.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 04dad17. Configure here.}