refactor: return errors from NewCLIInstance instead of panicking

Change NewCLIInstance() and NewCLIInstanceWithFs() to return
(*Instance, error) instead of panicking on DetermineStateDir failure.

Callers in RunE contexts propagate the error. Callers in command
construction (for shell completion) use log.Fatalf. Test callers
use t.Fatalf.

Addresses review feedback on PR #18.

internal/cli/cli.go

@@ -17,30 +17,30 @@ type Instance struct {
 }
 
 // NewCLIInstance creates a new CLI instance with the real filesystem
-func NewCLIInstance() *Instance {
+func NewCLIInstance() (*Instance, error) {
 	fs := afero.NewOsFs()
 	stateDir, err := secret.DetermineStateDir("")
 	if err != nil {
-		panic(fmt.Sprintf("cannot determine state directory: %v", err))
+		return nil, fmt.Errorf("cannot determine state directory: %w", err)
 	}
 
 	return &Instance{
 		fs:       fs,
 		stateDir: stateDir,
-	}
+	}, nil
 }
 
 // NewCLIInstanceWithFs creates a new CLI instance with the given filesystem (for testing)
-func NewCLIInstanceWithFs(fs afero.Fs) *Instance {
+func NewCLIInstanceWithFs(fs afero.Fs) (*Instance, error) {
 	stateDir, err := secret.DetermineStateDir("")
 	if err != nil {
-		panic(fmt.Sprintf("cannot determine state directory: %v", err))
+		return nil, fmt.Errorf("cannot determine state directory: %w", err)
 	}
 
 	return &Instance{
 		fs:       fs,
 		stateDir: stateDir,
-	}
+	}, nil
 }
 
 // NewCLIInstanceWithStateDir creates a new CLI instance with custom state directory (for testing)