Execute ap apply batches in dependency order

[rmorlok]

Enables ap apply to create, update, and report unchanged cluster resources. The complete batch is resolved and validated before writes, then executed in stable dependency order. Failed resources skip their dependents while independent resources continue; partial failures return a nonzero exit status and preserve successful writes.

• Check namespace parents and typed resource references, including missing prerequisites and dependency cycles. Existing namespace updates do not block resources that only require the namespace to exist.
• Support human, name, JSON, and YAML results with sanitized resources, plus --request-timeout and the existing authentication/configuration flags. Client dry-run remains offline.
• Handle cancellation and output failures without retrying mutations, and preserve Connection creation/update restrictions.
• Update CLI and package documentation with execution behavior, permissions, and partial failure semantics.

Conditional writes, conflict replanning, and connector generation lifecycle remain in #924. This change does not promise rollback or retry ambiguous mutations.

Validation:

• go test -race ./internal/apply ./internal/schema/registry ./cmd/cli/config ./cmd/cli
• Additional external-reference and conflicting-alias regression test passed under the race detector.
• yarn docs:build
• ./scripts/preflight.sh
• git diff --check

Closes #923.
Part of #919.

[rmorlok]

Please correct any mistakes I've made in the above sections but avoid making unnecessary rewrites.

Please add any other key terms/concepts.

[rmorlok]

Addressed in 16a6a8c. Preserved the overview while correcting typos and clarifying three-way comparison, managed-field drift, and secret exclusion with presence markers. Corrected Plan to mean one resource operation (create/update/unchanged), which can change multiple fields. Added Target, Reconciliation, Managed field, Batch, and Result, and clarified that the history version describes its storage format.

[rmorlok]

For this section and below feel free to make updates as you see fit (rewrite however much you want). Please review it and make sure it is presenting information in an order where a person with no knowledge of the system is walked through details about concepts in an order that builds on their knowledge. They will have the above overview to guide them, but avoid jumping between topics and concepts and try to progressively build the reader's understanding. Where necessary, introduce a concept with a simple, brief explanation before jumping into details.

[rmorlok]

Addressed in 16a6a8c. Reordered Details to follow loading/validation, connection and target resolution, plan computation, history storage, dependency ordering, and execution/results. Added a small label example for field management and introduced prerequisites, edges, and cycles before their implementation details. Consolidated repeated failure/retry explanations and checked the descriptions against the code. Preflight and git diff --check passed; this change only touches the package README.

[rmorlok]

Addressed the pending comment on Batch.dependency in da8ac8f. Added documentation for its behavior, all six parameters, namespace ordering exception, verification cache, generation checks, and errors. Preflight and git diff --check passed. GitHub rejected a direct thread reply because this account already has a pending review; leaving the update here without submitting or changing that review.