Clean up Decodex CLI argument ownership

[yvette-carlisle]

Summary

• move project config from a root-global flag to project-scoped subcommands
• hide internal compatibility flags from operator help while preserving app/runtime callers
• sync README, runbooks, and Decodex plugin skills with the new CLI semantics

Verification

• cargo make fmt
• cargo make fmt-check
• cargo test -p decodex cli::tests
• cargo check -p decodex --all-targets
• cargo make check-rust
• cargo build -p decodex --bin decodex
• CLI help/parse smoke checks for config ownership, hidden flags, and clap conflicts
• semantic drift audit via playbook helper