feat(cli)!: excise omnigraph.yaml from the CLI; policy/queries tooling reads --cluster (#251)

The server already dropped omnigraph.yaml (cluster-only boot). This removes the
CLI's last use of the legacy `OmnigraphConfig`: graphs are addressed only via
`--store`/`--server`/`--cluster`/`--profile`/operator defaults, and actor,
output format, and bearer credentials come from `~/.omnigraph/config.yaml`.
After this change no CLI command reads `omnigraph.yaml` except `config migrate`.

Resolvers (helpers.rs): drop every legacy fallback —
- `resolve_actor` → `--as` > `operator.actor` (no `cli.actor`);
- `resolve_read_format` → `--json`/`--format` > alias > `defaults.output`;
- `resolve_branch`/`resolve_read_target` → `--branch` > alias > "main";
- `resolve_uri`/`resolve_cli_graph` → scope path only; an absent address is a
  loud error;
- `resolve_remote_bearer_token` → operator keyed chain + `OMNIGRAPH_BEARER_TOKEN`.
`GraphClient::resolve`/`resolve_with_policy` drop the `&OmnigraphConfig` param;
direct-store access carries no Cedar policy (policy lives in the cluster/server).

Flags (cli.rs): remove `--config` from every data/query command; it stays only
on `cluster *` (the cluster dir) and `config migrate` (the legacy path).

Re-home control-plane tooling to `--cluster` (RFC-011):
- `policy validate|test|explain` source the Cedar bundle from the cluster's
  applied policies; `--graph` picks a graph's bundle; `policy test` takes
  `--tests <file>`;
- `queries list|validate` source the registry + schemas from the cluster
  serving snapshot; `--graph` scopes to one graph;
- `lint` requires `--schema` (offline) or a direct/cluster graph target;
- `schema plan`/`lint` route their graph-target through the shared direct-scope
  resolver so `--store`/`--profile`/`defaults.store` addressing works.

Tests migrate from `omnigraph.yaml` fixtures to `--store`/operator-config/
`--cluster` (converged-cluster fixtures); the now-impossible command-path
RFC-008 tests are deleted (`config migrate` coverage kept). The
`OmnigraphConfig` type, `load_config`/deprecation machinery, and `config
migrate` are removed in a follow-up.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

crates/omnigraph-cli/tests/parity_matrix.rs

@@ -25,13 +25,12 @@ const KNOWN_DIVERGENCES: &[&str] = &[
     // populated by the rows below as they are written
 ];
 
-/// One matched setup per row: twin graphs + the SAME Cedar bundle on both
-/// arms (the local arm via --config top-level policy.file; the server via
-/// its config). Returns everything a row needs.
+/// One matched setup per row: twin graphs + the parity Cedar bundle on the
+/// served arm. The local (`--store`) arm carries no policy (RFC-011); the
+/// bundle is permissive for `act-parity`, so the arms still agree.
 struct Parity {
     _temp: TempDir,
     local: std::path::PathBuf,
-    local_cfg: std::path::PathBuf,
     server: TestServer,
 }
 
@@ -40,7 +39,7 @@ fn parity() -> Parity {
     // RFC-011 cluster-only: the remote arm is served from a converged
     // cluster directory (one graph, id `parity`), seeded with the same
     // fixture data as the local twin.
-    let (local_cfg, cluster_dir) = parity_configs(temp.path(), &local, &remote);
+    let cluster_dir = parity_configs(temp.path(), &local, &remote);
     let server = spawn_server_with_cluster_env(
         &cluster_dir,
         &[(
@@ -51,14 +50,13 @@ fn parity() -> Parity {
     Parity {
         _temp: temp,
         local,
-        local_cfg,
         server,
     }
 }
 
 impl Parity {
     fn run(&self, args: &[&str]) -> (std::process::Output, std::process::Output) {
-        run_both_with_config(&self.local, Some(&self.local_cfg), &self.server.base_url, args)
+        run_both(&self.local, &self.server.base_url, args)
     }
 }