fix: preserve CLI targeting and embedding APIs with managed data access

[aaltshuler]

What & why

A folder containing .omnigraph/context currently intercepts explicit data targets and rejects unrelated graph commands. Restore ordinary routing for explicit selectors and unrelated commands, and restore the public Rust struct construction contracts changed by PR #633.

• Explicit --server, --profile, --store, --cluster, and --direct bypass managed data dispatch before reading context. Their existing command support rules still apply.
• Implicit query/mutate retain managed access when unambiguous. A valid folder context competing with OMNIGRAPH_PROFILE or an operator default target refuses before keychain access or requests. Selected managed access never falls back after credential, permission, or transport failure.
• ServerConfig, ServingSnapshot, and ResolvedActor regain their earlier public field shapes. Additive managed boot APIs bind trust to the same opened store before graph opening; an opaque authenticated actor preserves signed grant ceilings through every protected handler.

For example, omnigraph query find_person --profile staging --graph knowledge keeps using staging even from a folder bound to a managed production cluster. Local init/load/schema/commit operations also keep their normal behavior there, including beside malformed context.

Backing issue / RFC

• Implements an accepted RFC: RFC 0053, with its bounded compatibility amendment recorded in this change. The maintainer authorized this repair independently of the broader configuration/CLI proposal in draft PR docs: RFC 0059 and configuration/CLI framework #675.

Checklist

• Change is focused on the compatibility regression.
• Tests added/updated for behavior changes.
• Public docs, root CLI help, release notes, and the RFC updated.
• Reviewed against the architectural invariants; signed authorization, offline verification, and storage publication boundaries are preserved.

Local verification

• Integration with current main preserves opaque verified authority through GQ branch dispatch. All 107 focused server tests and the extended signed-token branch regression pass; both strict workspace Clippy configurations pass. All executed CI checks passed at bcc43770c88a2c25c60f366f17d9fe86f3f8e0e3 (https://github.com/ModernRelay/omnigraph/actions/runs/34057560778).

• Before implementation, the explicit-target and ambient-routing regressions failed on the original dispatcher. The external public-API fixture also failed to compile with the three incompatible struct shapes.

• cargo test --locked -p omnigraph-cli -p omnigraph-server -p omnigraph-cluster -- --test-threads=2 — passed, using the freshly built server binary for CLI system tests. This includes managed credential isolation, served/direct parity, boot trust, signed authorization, stored queries, and OpenAPI drift checks.

• Historical-binary and S3/Azure cases requiring external fixtures were skipped because those fixture variables were unset. Remote/operator and provider-specific ignored tests were not enabled. These results do not establish live pilot qualification.

• cargo clippy --locked -p omnigraph-cli -p omnigraph-server -p omnigraph-cluster --all-targets -- -D warnings -W clippy::dbg_macro — passed.

• cargo test --locked -p omnigraph-cli --test cli_schema_config help_groups_commands_by_capability -- --exact — passed after the final help-text edit; inspected the rebuilt binary's --help output.

• Formatting, documentation links/indexes, spelling, and whitespace checks — passed.

Notes for reviewers

The repair preserves the existing server flags, trust JSON, HTTP routes, storage formats, static-token behavior, and managed token protocol. Embedders that adopted the interim #633 fields migrate to the additive APIs described in the developer guide; both conflicting struct literal shapes cannot coexist. This PR does not implement new managed operator-YAML fields or change the control-plane dependency pin or deployed images. The canonical workspace feature-superset, AWS-feature, and cloud-provider CI gates remain required before merge.