Add sync/export/apply-dir commands to copy portable org state between instances

[andredlng]

Depends on datamesh-manager/entropy-data#1521 — that app PR adds GET/PUT /api/organization/features, which this PR's organization-features resource requires (already merged to app main). It must be deployed before sync/apply dir can copy organization features to a target instance. The rest of this PR works against the current API.

Summary

Adds commands to copy an organization's portable, declarative state from one Entropy Data instance to another — e.g. promoting a test environment's setup to production.

entropy-data export dir <path>  -c <source>                                    # enumerate a source into a local YAML tree
entropy-data apply  dir <path>  -c <target> [--include] [--prune] [--dry-run]  # apply a tree into a target (kubectl-apply style)
entropy-data import zip <file>  -c <target> [--prune]                          # unchanged (app-produced export zip)
entropy-data sync --source <conn> --target <conn> --include a,b [--exclude] [--prune] [--dry-run] [--keep <dir>]

• sync exports the source into a staged directory and applies it to the target in one step, producing an auditable, re-runnable transfer. --source and --target are both required. It copies nothing by default — the resources to copy must be named with --include, and a run without it exits non-zero listing the known resources. Supports --exclude, --prune, --dry-run (per-resource create/update/prune counts), and --keep <dir>.
• export dir enumerates a source into a local YAML tree, mirroring the app's organization-export layout so artifacts interchange.
• apply dir reconciles such a tree into the connected instance, in the spirit of kubectl apply -f <dir>. Uses a folder-as-kind convention: the folder name is the resource kind and each YAML file below it is one resource (addressed by the id in its body); files carry no kind: field, so the enclosing folder is authoritative and unknown folders are ignored. Applies the whole tree by default (the directory is the selection); --include/--exclude narrow it, --dry-run previews, --prune mirrors deletions. apply dir --help enumerates the recognized folder names.
• import zip is unchanged (Simon's command); it now extracts to a temp dir and applies through the same engine.
• Fix: the tree apply silently dropped sourcesystems/ from an org export — now applied in its correct dependency position (after policies, before assets).
• Copies teams, tags, definitions, policies, sourcesystems, certifications, classification-schemes, assets, datacontracts, dataproducts, example-data, access, the semantics graph (namespace rows + one OSI ontology YAML document per namespace), and the organization feature configuration (singleton).

One shared resources.py/sync.py engine drives export, apply and sync so they cannot drift, with three resource shapes:

• Flat — /api/{path} list + /api/{path}/{id}; artifact <name>/<id>.yaml.
• Document (semantics ontology) — one raw-YAML document per namespace, GET/PUT at .../{ns}/ontology.yaml; artifact <name>/<namespace>.yaml; the app imports the whole document in correct internal order (groups before members, concepts before relationships). Not pruned.
• Singleton (organization-features) — one object at /api/{path} (no id, no list); artifact <name>/<name>.yaml; applied last so a restrictive managedTagsPolicy it carries cannot reject earlier writes; never pruned.

All writes are idempotent PUT-by-id (or PUT-to-path for the document/singleton); the run is continue-on-error with a per-resource summary and non-zero exit on any failure.

Discoverability

sync --help and apply dir --help both list the supported resource kinds (folder names), built from the single RESOURCE_ORDER source. sync without --include, or a bad --include, errors with the known-resource list.

Not synced

Users & team members, API keys, git credentials, integration/connector credentials, usage, costs, test results, events, and lineage (per-instance identity, secrets, or telemetry). Organization customization, SCIM mapping, team-roles config, notification channels, connectors, and integrations are not supported yet.

Testing

ruff check/ruff format clean; pytest — 278 passed (27 in the export/apply/sync suite, covering flat + document semantics + singleton export/apply/prune, upsert ordering, prune reverse-order + absent-only, sync orchestration, the --include-required guard, apply dir --help kind listing, and the sourcesystems fix). The only local failures are 3 pre-existing machine-specific truststore tests, green in CI.

Docs

Companion docs PR: entropy-data/entropy-data-docs#124 (environment-sync how-to + CLI reference, folder-as-kind layout, recognized folder names). The changelog links to the guide and the CLI reference Links section links back to the changelog.