bug(web): app-groups assign fails for 98% of installs with an unclassified internal error

Summary

asc web app-groups assign fails for 98.5% of the 31 distinct installs that used it (5.x, last 14 days), always as an unclassified internal_error with diagnostic_code = NULL. This is the highest failure rate of any live command not already covered by an open PR.

What to do

Reproduce from code and fixtures (no live web session is available to agents): read internal/cli/web app-groups assign and the Developer Portal client it calls; find the path that returns a plain error (request shape, missing relationship, response decode, session state). Fix the root cause where provable; where a live session is required, convert user-fixable failures to usage errors (exit 2) with clear messages and give every remaining failure a diagnostic code so telemetry stops recording it as internal_error. Compare with web app-groups list, which succeeds.

Acceptance criteria

• RED httptest reproducing the failure, GREEN after the fix
• no assign failure path without a diagnostic code
• PR body states precisely what still needs live verification