[codex] fix RFC-011 follow-up regressions (#258)

* fix rfc-011 follow-up regressions

* test(cli): remove served schema-apply tests obsoleted by the cluster 409

This PR disables server-side schema apply for cluster-backed serving (409 →
`omnigraph cluster apply`). Two system_local tests still drove *served* schema
apply against a spawned `--cluster` server and asserted the pre-409 behavior, so
they failed under `cargo test --workspace`:

- `local_cli_schema_apply_enforces_engine_layer_policy` — expected a per-actor
  policy `denied`/allow on the served route; the route now 409s for everyone
  before policy runs.
- `local_cli_schema_apply_rejects_stored_query_breakage_before_publish` —
  expected a served apply to reject a stored-query breakage; the route now 409s
  before any apply.

Both exercise a path the PR intentionally removed. Their surviving coverage:
the 409 itself is pinned by `schema_routes::schema_apply_route_refuses_cluster_backed_server_mode`
(asserts 409 + no mutation); stored-query-breakage-before-publish stays covered
by `schema_routes::schema_apply_route_rejects_stored_query_breakage_before_publish`
(single-mode); engine-layer schema_apply Cedar enforcement stays covered by
`policy_engine_chassis`. Remove the obsolete served versions.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(server): report the cluster-backed schema-apply 409 after the Cedar gate

The 409 ("schema apply is disabled for cluster-backed serving") fired at the top
of `server_schema_apply`, before `authorize_request`. An authenticated-but-
unauthorized actor therefore learned the server is cluster-backed (409) instead
of getting a normal 403 — leaking topology before authorization, against the
same posture that keeps `GET /graphs` default-deny.

Move the 409 below the Cedar gate so the route reports 401 → 403 → 409: an
unauthorized actor gets 403, and only an actor authorized for `schema_apply`
sees the actionable "use `omnigraph cluster apply`" 409. (An open/unauthenticated
server still 409s, as it has no topology to protect.)

Regression: `schema_apply_route_cluster_backed_denies_unauthorized_actor_before_409`
(POLICY_YAML grants no schema_apply → act-ragnor gets 403, not 409). Addresses the
bot-review finding on #258.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

crates/omnigraph-cli/tests/cli_queries.rs

@@ -94,6 +94,49 @@ fn alias_unknown_name_errors_listing_defined() {
     );
 }
 
+#[test]
+fn alias_rejects_global_scope_flags_that_the_binding_owns() {
+    for (flag, value) in [
+        ("--server", "dev"),
+        ("--graph", "local"),
+        ("--store", "file:///tmp/graph.omni"),
+        ("--cluster", "."),
+        ("--profile", "prod"),
+        ("--as", "act-op"),
+    ] {
+        let output = output_failure(cli().arg(flag).arg(value).arg("alias").arg("who"));
+        let stderr = String::from_utf8_lossy(&output.stderr);
+        assert!(
+            stderr.contains("`alias` uses the server, graph, and stored query")
+                && stderr.contains(flag),
+            "expected {flag} to be rejected by the alias binding guard; got: {stderr}"
+        );
+    }
+}
+
+#[test]
+fn queries_and_policy_wrong_server_scope_points_at_cluster_scope() {
+    let output = output_failure(cli().arg("--server").arg("prod").arg("queries").arg("list"));
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    assert!(
+        stderr.contains("pass --cluster <dir|uri>") && !stderr.contains("pass --config <dir>"),
+        "queries should point at --cluster, not --config; got: {stderr}"
+    );
+
+    let output = output_failure(
+        cli()
+            .arg("--server")
+            .arg("prod")
+            .arg("policy")
+            .arg("validate"),
+    );
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    assert!(
+        stderr.contains("pass --cluster <dir|uri>") && !stderr.contains("pass --config <dir>"),
+        "policy should point at --cluster, not --config; got: {stderr}"
+    );
+}
+
 // RFC-011: `queries validate`/`list` source the registry + schemas from a
 // converged cluster's applied state (`--cluster <dir>`), not omnigraph.yaml.