Warn after fly secrets push when staged secrets are not live on running machines

[ReganBell]

Why

In a real deployment, an operator ran qm secrets push and then restarted the Fly machines expecting the new secrets to take effect. On Fly, secrets set --stage only stages values — they are applied by the next deploy/machine update, not by flyctl machine restart. The result was the auth service running with no SMTP credentials at all until a full qm up was run. The command's existing output mentioned staging, but not strongly or actionably enough to prevent the mistake.

What

• flySecretsPush now tracks every app that received staged secrets and checks each for running machines (fly status --json). If any have machines, the command ends with an explicit warning:
  • staged secrets are NOT live yet on <apps>: running machines keep their old values
  • run \qm up` to apply them — a plain machine restart does not`
• Fresh installs (no machines yet) see no warning, so first-time setup output stays clean.
• No new flags or behavior changes — staging semantics are untouched; this only closes the messaging gap at the single layer all Fly secret pushes flow through.

Tests

• New test: warning is printed when a staged app has running machines.
• New test: no warning when no machines are running.
• cli suite (node --test test/fly-sandbox.test.ts): 33/33 pass. npm run typecheck and eslint clean.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}