fix(cli): honor the atespace flag when applying resources

[ktsoator]

With a manifest that omits metadata.atespace, ax apply -a team-a -f workspace.yaml succeeds but creates the resource in default. The CLI parses the flag but doesn't pass it to runApply.

Pass the explicit atespace through to apply and use it before looking up or submitting Tasks, Workspaces, and Models. When no flag is given, the manifest's atespace is preserved and missing values still default to default.

This also rejects a resource when its manifest atespace differs from an explicitly supplied flag, including -a default. Would you prefer a different precedence rule for that case?

Added CLI integration tests covering resource placement, repeated apply, and conflicting atespaces, and documented the behavior. Verified with make test, make build, and go mod tidy with no module changes.

Refs #414

[ktsoator]

Adding the reproduction steps and before/after output. I ran both versions against fresh local AX gRPC servers using the in-memory store, with AX_SERVER pointing to each server.

Save this as workspace.yaml:

apiVersion: ax.io/v1alpha1
kind: Workspace
metadata:
  name: atespace-example
spec: {}

Before (c5c1ac5):

$ ax apply -a team-a -f workspace.yaml
workspace.ax.io/atespace-example created
$ ax get workspaces -a team-a
NAME   ATESPACE   GIT-REPOS   MCP-SERVERS
$ ax get workspaces -a default
NAME               ATESPACE   GIT-REPOS   MCP-SERVERS
atespace-example   default    0           0

After (b3ee331):

$ ax apply -a team-a -f workspace.yaml
workspace.ax.io/atespace-example created
$ ax get workspaces -a team-a
NAME               ATESPACE   GIT-REPOS   MCP-SERVERS
atespace-example   team-a     0           0
$ ax get workspaces -a default
NAME   ATESPACE   GIT-REPOS   MCP-SERVERS

[ktsoator]

Synced with the latest main and resolved the conflicts. Updated the tests for the new Task creation behavior. make test and make build pass.

[mayawang]

Thanks @ktsoator, the before/after repro made this easy to check. It merges cleanly with current main and go test ./... passes. Filling a missing atespace from -a and rejecting a mismatch looks right.

One thought: in a multi-document file, a mismatch on document 3 fails after documents 1 and 2 are already applied. Checking every document's atespace before submitting anything would avoid a half-applied file. Happy for that to be a follow-up.

Heads-up that #411 (ax ssh --help and -- parsing) moves the same global flag loop in main() into a parseGlobalArgs helper, so whichever merges second will need a small rebase.