New "teleport relay" path for streaming completions

A new "teleport relay" path can intercept outgoing streaming /v1/messages requests and, when a remote/CCR session is active, route them through a /teleport/conversations/.../completion endpoint on the session's ingress origin instead of the normal path. It tracks an arming state machine (inactive/active/reverted) and falls back to standard dispatch on model mismatches, changed tool fingerprints, non-SSE responses, HTTP errors, timeouts, or a 409 with a teleport_relay_refused discriminant, logging cli_teleport_relay_fallback and a telemetry event upgrade_teleport_cache with a reason such as context_reduced, tools_changed, relay_unreachable, relay_dispatch_timeout, relay_refused, relay_not_sse, or model_mismatch.