feat(cli): add global --stage invocation override

[shadowhand]

Add -g / --stage as a global option that overrides the active profile's configured stage for a single invocation. The override retargets the API host and, for rw auth login, the WorkOS tenant — nothing else.

config::resolve_profile gains a stage_override parameter so that one function decides the effective stage; build_ctx and config doctor both inherit it. Profile-resolution errors still fire before any override applies.

AppContext.auth_stage is deliberately not overridden. It keeps reading the credential-owning profile's stored stage, so token refresh still targets the tenant that issued the stored refresh token. As a consequence, an override crossing the prod/sandbox <-> qa/dev/local tenant boundary sends a token the target rejects and gets a 401; in-tenant hops work. This is accepted behavior, documented in README.md.

check_stage_compatible rejects the override on rw auth login and rw auth logout: login mints from the overridden stage's tenant but stores under the profile, which across tenants leaves a token the profile can never refresh. Within a tenant the minted token is identical either way, so the guard forfeits nothing.

Known behavior: on rw config profile add and rw config profile set, -g / --stage sets the profile's stored stage regardless of where it appears on the command line, because clap propagates global argument values bidirectionally across the match tree and both flags share the arg id stage. Dropping global = true would fix it but would also stop -g parsing after the subcommand; a guard is not implementable, since the upward propagation makes the two flag positions indistinguishable through clap's derive API. Documented in README.md, docs/config.md, and skills/rw-skill.md.

Resolves CL-8