perf: skip the SDK import on custom-domain cache hits

[cloudsmith-iduffy]

Description

Skip the cloudsmith_api SDK import when the custom-domains cache is warm.

credential_helpers/custom_domains.py imported core.api.exceptions, core.api.init and core.api.orgs at module level, which loads the full SDK. The docker/pnpm helpers import this module on every invocation, but the SDK is only needed on a custom-domains cache miss — at most once every 7 days per org. Move the three imports after the cache check.

Results

Measured on macOS (M-series), Python 3.14.7, PYTHONDONTWRITEBYTECODE=1 (repo .envrc default). Baseline column = #375.

Command	#375	This PR	Delta
credential-helper docker get (warm cache)	0.37 s	0.30 s	-19%

Cumulative vs master: 2.94 s → 0.30 s (-90%).

Methodology (how to reproduce)

1. After perf: keep the SDK and requests out of startup #375, startup imports are clean, so profile the run phase in-process:

   import cProfile, pstats, sys
   from cloudsmith_cli.cli.commands.main import main
   pr = cProfile.Profile(); pr.enable()
   main(args=["credential-helper", "docker", "get"], standalone_mode=False)
   pr.disable()
   pstats.Stats(pr, stream=sys.stderr).sort_stats("cumulative").print_stats(20)

   (Pipe docker.cloudsmith.io to stdin.) Top cost: credential_helpers/custom_domains.py module import at 141 ms — the deferred-until-runtime SDK chain from perf: keep the SDK and requests out of startup #375 resurfacing through this module. Second: the keyring backend detection at ~76 ms (see Additional Notes).

2. Everything the three imports serve sits below the cache-hit early return in get_custom_domains(), so deferring them changes no behaviour on any path.

3. Regression guard: test_startup_imports.py now also probes import cloudsmith_cli.credential_helpers.docker in a subprocess and asserts no cloudsmith_api/requests/mcp/httpx module loads (written first, failed with the SDK loaded).

4. test_credential_helper_install.py patched custom_domains.list_custom_domains; the name no longer exists at module scope, so the patch target moves to the defining module core.api.orgs (the call-time import resolves through it).

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Refactoring
• Other (please describe)

Flame graphs

Probe: import cloudsmith_cli.cli.commands.credential_helper (what a docker helper invocation imports at run time). Icicle charts from python -X importtime: parents above children, width = cumulative import time. Totals include the interpreter's own site imports and vary a few ms between runs.

Before:

After: