Support team assignments when creating and copying pipelines

[lizrabuya]

Description

bk pipeline cp currently omits team assignments when creating the copy. In organizations with Teams enabled, non-admin users must supply teams at creation time or the API rejects the request with a 422.

This adds team assignments to the initial creation request, rather than attempting to attach them afterward. Same-organization copies preserve source teams and access levels by default; users can also select destination teams explicitly by slug.

Changes

• Add repeatable --team SLUG=ACCESS_LEVEL flags to pipeline create and pipeline cp. Supported access levels are read_only, build_and_read, and manage_build_and_read.
• Resolve explicit slugs in the destination organization using REST (read_teams access required). Explicit assignments replace, rather than merge with, source assignments.
• Read source assignments through paginated GraphQL queries for same-organization copies without --team. Cross-organization copies do not inherit teams.
• Include resolved assignments in dry-run output and update command help.

bk pipeline cp source --target copy
bk pipeline cp source --target copy --team platform-engineering=build_and_read
bk pipeline create "My Pipeline" --repository git@github.com:org/repo.git \
  --team platform-engineering=manage_build_and_read

Review consideration: automatic same-org copying now requires the token's graphql scope, including for dry runs. Lookup failures stop the command before creation and suggest explicit --team flags, which bypass GraphQL. Create without teams, and cross-org copy without teams, still rely on the API's existing authorization/validation rules.

Testing

• Tests have run locally (go test ./...).
• Code is formatted (repository-pinned gofumpt).
• Lint passed with 0 issues.
• Mock-API tests cover slug resolution, pagination, access levels, destination-org overrides, lookup failures, dry runs, creation without teams returning 422, and copying a source with no teams. The last two exercise the command Run paths.
• Live read-only dry runs passed for explicit-team create and copy. Automatic preservation was attempted but blocked by the test token's missing graphql scope. No real pipeline creation was attempted.

Disclosures / Credits

Amp implemented the code and tests, updated CLI help, ran validation and dry-run demonstrations, and drafted this PR description under the author's direction.