feat: upgrade pan-scm-sdk to ^0.13.0 and add region support

[cdot65]

Overview

Upgrade pan-scm-sdk from ^0.12.2 to ^0.13.0 and integrate the new region parameter. This is the foundation PR that must land before any of the three new command modules (local config, device operations, incidents).

Context

SDK 0.13.0 (April 2026) adds:

• Operations API: client.local_config, client.device_operations
• Incidents API: client.incidents
• region parameter on Scm client for APIs requiring X-PANW-Region header (default: "americas")
• raw_response support in Scm.request() for binary file downloads
• JobTimeoutError exception for sync job polling timeouts
• Pydantic models for all new services

This issue covers ONLY the SDK bump and region plumbing. New commands are tracked in separate issues.

Design Decisions (from brainstorming session 2026-04-16)

1. Region stored per-context: scm context create gains --region option (default "americas"), persisted in ~/.scm-cli/contexts/<name>.yaml
2. Global --region flag overrides context: scm --region europe incidents list ... overrides the stored context value for that invocation
3. Backward compatible: Existing contexts without a region field default to "americas"

Scope

• In scope:
  • Bump pan-scm-sdk in pyproject.toml from ^0.12.2 to ^0.13.0
  • Run poetry update pan-scm-sdk and verify lock file
  • Add --region option to scm context create in commands/context.py
  • Store region field in context YAML files (utils/context.py)
  • Add global --region callback/option to main.py app
  • Update client.py to pass region to Scm() constructor (context value → global override → default "americas")
  • Handle JobTimeoutError in sdk_client.py _handle_api_exception
  • Update mock mode in client.py to accept region gracefully
  • Tests for region in context create, region override, backward compat with old contexts
  • Verify all existing tests still pass (no SDK breaking changes)
• Out of scope:
  • New command modules (local, operations, incidents) — see #ISSUE_LOCAL, #ISSUE_OPS, #ISSUE_INCIDENTS
  • raw_response usage (handled in local config download)

Acceptance Criteria

• pyproject.toml specifies pan-scm-sdk = "^0.13.0"
• poetry lock succeeds and SDK 0.13.x is resolved
• scm context create <name> --client-id ... --region europe stores region in context YAML
• scm --region americas context list works (global flag parsed)
• Existing contexts without region field default to "americas" without error
• client.py passes region= to Scm() constructor
• JobTimeoutError is caught and handled with useful error message including job_id
• All existing tests pass (0 regressions)
• New tests for region context storage, override precedence, backward compat
• make quality passes

Implementation Notes

• Region override precedence: global --region flag > context's stored region > "americas"
• Context YAML schema adds optional region: str field
• The Scm client constructor signature in 0.13.0: Scm(client_id=..., client_secret=..., tsg_id=..., region=...)
• JobTimeoutError includes job_id and last_state attrs for manual recovery messaging

[cdot65]

Dependency Chain

This is the foundation issue. The following issues depend on this landing first:

• feat: add local config commands (list versions, download XML) #213 — scm local commands (local config list/download)
• feat: add device operations commands (dispatch/monitor jobs) #214 — scm operations commands (device operations dispatch/monitor)
• feat: add incidents commands (search, show, alerts) #215 — scm incidents commands (incident search/show)

Implementation order: #212 → #213 / #214 / #215 (last three can go in any order after foundation lands)