feat(cli)!: excise omnigraph.yaml from the CLI; policy/queries tooling reads --cluster (#251)

The server already dropped omnigraph.yaml (cluster-only boot). This removes the
CLI's last use of the legacy `OmnigraphConfig`: graphs are addressed only via
`--store`/`--server`/`--cluster`/`--profile`/operator defaults, and actor,
output format, and bearer credentials come from `~/.omnigraph/config.yaml`.
After this change no CLI command reads `omnigraph.yaml` except `config migrate`.

Resolvers (helpers.rs): drop every legacy fallback —
- `resolve_actor` → `--as` > `operator.actor` (no `cli.actor`);
- `resolve_read_format` → `--json`/`--format` > alias > `defaults.output`;
- `resolve_branch`/`resolve_read_target` → `--branch` > alias > "main";
- `resolve_uri`/`resolve_cli_graph` → scope path only; an absent address is a
  loud error;
- `resolve_remote_bearer_token` → operator keyed chain + `OMNIGRAPH_BEARER_TOKEN`.
`GraphClient::resolve`/`resolve_with_policy` drop the `&OmnigraphConfig` param;
direct-store access carries no Cedar policy (policy lives in the cluster/server).

Flags (cli.rs): remove `--config` from every data/query command; it stays only
on `cluster *` (the cluster dir) and `config migrate` (the legacy path).

Re-home control-plane tooling to `--cluster` (RFC-011):
- `policy validate|test|explain` source the Cedar bundle from the cluster's
  applied policies; `--graph` picks a graph's bundle; `policy test` takes
  `--tests <file>`;
- `queries list|validate` source the registry + schemas from the cluster
  serving snapshot; `--graph` scopes to one graph;
- `lint` requires `--schema` (offline) or a direct/cluster graph target;
- `schema plan`/`lint` route their graph-target through the shared direct-scope
  resolver so `--store`/`--profile`/`defaults.store` addressing works.

Tests migrate from `omnigraph.yaml` fixtures to `--store`/operator-config/
`--cluster` (converged-cluster fixtures); the now-impossible command-path
RFC-008 tests are deleted (`config migrate` coverage kept). The
`OmnigraphConfig` type, `load_config`/deprecation machinery, and `config
migrate` are removed in a follow-up.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

crates/omnigraph-cli/src/planes.rs

@@ -82,9 +82,7 @@ impl Capability {
 /// classifier) plus the one Data→Served refinement: `graphs` is remote-only.
 ///
 /// This reflects *current enforced behavior*, so messages stay truthful:
-/// `queries list` is `Local` (reads config today) and `queries validate` is
-/// `Direct` (opens a graph directly today). Both converge to the RFC end-state
-/// (served / control) only when later slices re-route them.
+/// `queries`/`policy` read a cluster's applied state (`Control`).
 pub(crate) fn command_capability(cmd: &Command) -> Capability {
     if let Command::Graphs { .. } = cmd {
         return Capability::Served;
@@ -120,20 +118,18 @@ pub(crate) fn command_plane(cmd: &Command) -> Plane {
         Command::Schema {
             command: SchemaCommand::Plan { .. },
         } => Plane::Storage,
-        Command::Queries {
-            command: QueriesCommand::Validate { .. },
-        } => Plane::Storage,
-        Command::Queries {
-            command: QueriesCommand::List { .. },
-        } => Plane::Session,
+        // `queries` and `policy` tooling now source their inputs from a
+        // cluster's applied state (`--cluster`), so they live on the control
+        // plane (RFC-011 — omnigraph.yaml excised from the CLI).
+        Command::Queries { .. } => Plane::Control,
+        Command::Policy { .. } => Plane::Control,
         Command::Init { .. }
         | Command::Optimize { .. }
         | Command::Repair { .. }
         | Command::Cleanup { .. }
         | Command::Lint { .. } => Plane::Storage,
         Command::Cluster { .. } => Plane::Control,
-        Command::Policy { .. }
-        | Command::Embed(_)
+        Command::Embed(_)
         | Command::Login { .. }
         | Command::Logout { .. }
         | Command::Config { .. }
@@ -188,7 +184,17 @@ pub(crate) fn command_label(cmd: &Command) -> &'static str {
 pub(crate) fn accepts_cluster_addressing(cmd: &Command) -> bool {
     matches!(
         cmd,
-        Command::Optimize { .. } | Command::Repair { .. } | Command::Cleanup { .. }
+        Command::Optimize { .. }
+            | Command::Repair { .. }
+            | Command::Cleanup { .. }
+            // `lint` can type-check a `.gq` against a cluster graph's schema
+            // (RFC-011): `--cluster <dir> --graph <id>`.
+            | Command::Lint { .. }
+            // The policy/queries tooling addresses a cluster's applied state
+            // (RFC-011): `--cluster <dir>` selects the cluster, `--graph <id>`
+            // picks a graph's bundle/registry within it.
+            | Command::Policy { .. }
+            | Command::Queries { .. }
     )
 }
 
@@ -284,7 +290,12 @@ mod tests {
         assert_eq!(cap(&["omnigraph", "schema", "plan", "--schema", "s.pg", "graph.omni"]), Capability::Direct);
         assert_eq!(cap(&["omnigraph", "cluster", "status", "--config", "."]), Capability::Control);
         assert_eq!(cap(&["omnigraph", "version"]), Capability::Local);
-        assert_eq!(cap(&["omnigraph", "queries", "list"]), Capability::Local);
+        // `queries`/`policy` tooling reads cluster state now (control plane).
+        assert_eq!(cap(&["omnigraph", "queries", "list"]), Capability::Control);
+        assert_eq!(
+            cap(&["omnigraph", "policy", "validate"]),
+            Capability::Control
+        );
     }
 
     #[test]