fix(cli): honor the atespace flag when applying resources

[ktsoator]

With a manifest that omits metadata.atespace, ax apply -a team-a -f workspace.yaml succeeds but creates the resource in default. The CLI parses the flag but doesn't pass it to runApply.

Pass the explicit atespace through to apply and use it before looking up or submitting Tasks, Workspaces, and Models. When no flag is given, the manifest's atespace is preserved and missing values still default to default.

This also rejects a resource when its manifest atespace differs from an explicitly supplied flag, including -a default. Would you prefer a different precedence rule for that case?

Added CLI integration tests covering resource placement, repeated apply, and conflicting atespaces, and documented the behavior. Verified with make test, make build, and go mod tidy with no module changes.

Refs #414

[ktsoator]

Adding the reproduction steps and before/after output. I ran both versions against fresh local AX gRPC servers using the in-memory store, with AX_SERVER pointing to each server.

Save this as workspace.yaml:

apiVersion: ax.io/v1alpha1
kind: Workspace
metadata:
  name: atespace-example
spec: {}

Before (c5c1ac5):

$ ax apply -a team-a -f workspace.yaml
workspace.ax.io/atespace-example created
$ ax get workspaces -a team-a
NAME   ATESPACE   GIT-REPOS   MCP-SERVERS
$ ax get workspaces -a default
NAME               ATESPACE   GIT-REPOS   MCP-SERVERS
atespace-example   default    0           0

After (b3ee331):

$ ax apply -a team-a -f workspace.yaml
workspace.ax.io/atespace-example created
$ ax get workspaces -a team-a
NAME               ATESPACE   GIT-REPOS   MCP-SERVERS
atespace-example   team-a     0           0
$ ax get workspaces -a default
NAME   ATESPACE   GIT-REPOS   MCP-SERVERS