support: migrate support commands to runseal

[PerishCode]

Why

Repo-local support commands were still routed through ./cli.sh, which duplicated
the wrapper dispatch shape that runseal now provides.

What

• Add a repo-local runseal.toml with .local resource paths.
• Add .runseal wrappers for :cloudflare, :pr, and :release backed by a
  shared uv/Python module launcher.
• Remove cli.sh without a compatibility shim.
• Update support command help text, init checks, hooks, README, and AGENTS docs
  to use runseal :....

Tests

• runseal @profile
• runseal @wrappers
• runseal :pr --help
• runseal :release --help
• runseal :cloudflare
• python3 scripts/init.py
• sh -n .runseal/lib/python-module
• sh -n .runseal/wrappers/cloudflare
• sh -n .runseal/wrappers/pr
• sh -n .runseal/wrappers/release
• python3 -m py_compile scripts/init.py scripts/cli/cloudflare.py scripts/cli/pr.py scripts/cli/release.py
• rg -n "cli\\.sh|\\.\\/cli\\.sh" .
• runseal @resolve resource:// resource://secrets resource://tmp
• runseal printenv RUNSEAL_REPO_LOCAL_DIR
• runseal printenv RUNSEAL_REPO_SECRETS_DIR
• runseal printenv RUNSEAL_REPO_TMP_DIR
• commit hook: cargo fmt --all --check, cargo check --locked --workspace,
  cargo run --locked -p flavor-cli -- check --root . --config flavor.json,
  shell syntax, Python syntax; PowerShell syntax skipped because pwsh is not
  installed locally.

Compatibility

This intentionally removes the ./cli.sh :... entrypoint. Repo-local support
commands now require runseal.