fix(cli,server): correct remaining --target references to --graph

L6 renamed the flag but left stragglers. Two were functional: the
`resolve_target_uri` "URI must be provided …" error still named `--target`, and
`docker/entrypoint.sh` passed `--target` to omnigraph-server (which now only
accepts `--graph`) — so the container failed to boot. Both fixed (plus the
entrypoint smoke test's expected args). The rest are code comments across the
config/server/cli crates and tests, and the cheat sheet, swept `--target` →
`--graph`. `--target-branch` (policy explain) is a distinct flag and untouched;
past release notes keep `--target` (accurate for those versions).

crates/omnigraph-cli/src/main.rs

@@ -1771,7 +1771,7 @@ struct QueriesListOutput {
 /// Resolve the selected graph to `(local URI, registry selection)` from one
 /// precedence, so a command's schema and its stored-query registry can never
 /// come from different graphs. A **positional URI is anonymous** (top-level
-/// registry, ignoring the configured default graph); otherwise `--target`
+/// registry, ignoring the configured default graph); otherwise `--graph`
 /// or the configured `cli.graph` names the graph (its per-graph block).
 /// Mirrors the server's single-mode identity rule.
 fn resolve_selected_graph(
@@ -1861,7 +1861,7 @@ async fn execute_queries_validate(
 ) -> Result<()> {
     let config = load_cli_config(config_path)?;
     // One selection drives both the schema URI and the registry, so a
-    // positional URI and a `--target` can't validate different graphs.
+    // positional URI and a `--graph` can't validate different graphs.
     let (uri, selected) =
         resolve_selected_graph(&config, uri, target.as_deref(), "queries validate")?;
     let registry = load_registry_or_report(&config, selected.as_deref())?;

crates/omnigraph-cli/tests/system_remote.rs

@@ -1028,7 +1028,7 @@ graphs:
         )],
     );
 
-    // Client config — the CLI's `--target dev` resolves to `server.base_url`.
+    // Client config — the CLI's `--graph dev` resolves to `server.base_url`.
     let client_config_path = cfg_dir.path().join("client.yaml");
     fs::write(
         &client_config_path,