feat: add cline template

[phala-agent]

Summary

• Adds a Phala Cloud prebuilt template for cline/cline.
• Uses a CPU-safe Node.js HTTP verifier that installs the real npm cline package, imports the installed @cline/sdk entrypoint, and checks cline --version without provider credentials or hosted model calls.
• Adds upstream icon asset from assets/icons/icon.png as templates/icons/cline.png.

Upstream

• Repository: https://github.com/cline/cline
• npm package: cline@3.0.13
• Author attribution: cline

Template files

• templates/prebuilt/cline/docker-compose.yml
• templates/prebuilt/cline/README.md
• templates/icons/cline.png
• templates/config.json

Environment variables

• CLINE_PACKAGE_VERSION optional, defaults to 3.0.13
• ANTHROPIC_API_KEY optional for future real Cline sessions; verifier endpoints do not use it
• OPENAI_API_KEY optional for future real Cline sessions; verifier endpoints do not use it
• OPENAI_BASE_URL optional for future custom provider workflows; verifier endpoints do not use it

Validation

• python sdks/templates/validate.py passed via a temporary python -> python3 PATH shim because this cron environment lacks a system python binary; validation output succeeded with existing unused-icon warnings for mcp-jupyter.svg and maybe-finance.png.
• git -C sdks diff --check origin/main...HEAD passed.
• docker compose -f sdks/templates/prebuilt/cline/docker-compose.yml config >/dev/null passed.
• Static audit passed: README has deploy/use/verification coverage; config ID is unique; repo routes to the Phala prebuilt directory; icon file exists; compose has no host bind mounts, no env_file, no external build context, no privileged mode, and no literal secrets.

Phala Cloud smoke test

• Profile/workspace: hermes-admin-cvm-check
• Deploy command shape: phala deploy --name auto-template-test-cline-0526-211226 --compose sdks/templates/prebuilt/cline/docker-compose.yml --instance-type tdx.small --wait --no-public-logs --no-public-sysinfo --json
• Smoke CVM UUID: 33fb757d-b0c7-4713-ab70-c6ff957f13ea
• App ID: 51e7484e98af9ecadc95b471ed07b2c1723514a1
• Container: /dstack-app-1 reached Up About a minute (healthy).
• GET /healthz returned HTTP 200 with status=ok, package metadata ready, SDK import ready, CLI ready, and version ready.
• GET /demo returned HTTP 200 with safe deterministic package and CLI smoke mode, credentials_required=false, and model_downloaded=false.
• GET /v1/models returned HTTP 200 with cline-cli/local-verifier and remote_model_calls=false.

Cleanup

• Temporary smoke CVM was deleted.
• Post-delete verification returned The requested CVM was not found, treated as cleanup success.

[phala-agent]

cc @Marvin-Cypher for review.