refactor: unify workspace root resolution; fix cloud project-config layering + secret-name encoding

[markovejnovic]

Stacked on #152 (cli-41-secrets) — it builds on hm-core, which only exists there, so --base cli-41-secrets keeps the diff to the refactor alone. Contains no secrets-interface scaffolding.

Three independent commits, each builds standalone (verified in detached worktrees).

---

291b80e — unify root resolution behind Workspace::resolve

Three verbs each hand-rolled the same block, none consulting a Workspace:

let root = match args.dir { Some(d) => d, None => current_dir()? };

Workspace::resolve now owns the single rule: --dir names the root verbatim, no walk-up (the backend runs discovery against cloned repo roots — walking up out of a clone could bind to an unrelated .hm/ above it); no --dir walks up from cwd.

Fixes a real divergence in hm run. render_pipeline took a &RunContext holding a fully-validated Workspace, ignored it (the param was literally _ctx), and recomputed the root from --dir/cwd. That PathBuf became req.repo_root and propagated into the scheduler, archive builder, secret resolver, and cloud backend — so with --dir, config came from one tree and code from another.

Side effect: hm run --dir X now works from a cwd outside any workspace. It previously died with "no harmont workspace found" because from_cli walked up from cwd and ignored --dir.

⚠️ Behaviour change worth your eyes: hm render / hm pipelines now walk up when given no --dir, where they were cwd-exact and failed in subdirectories. Discovery is unaffected — the backend always passes --dir.

hm pipelines keeps its empty-envelope contract: only NotFound/InvalidPath/InvalidWorkspace map to it, so a malformed .hm/config.toml still fails loudly instead of masquerading as a repo with no pipelines.

14c2b2f — cloud verbs read the project .hm/config.toml layer

They called Config::load(None) (user + env only), so [cloud] org in a project config was silently ignored — while the error message named the very file being ignored:

no organization — set [cloud] org = "…" in ~/.config/hm/config.toml (or .hm/config.toml)

hm run read it correctly via ctx.workspace.config(), so the two halves of the CLI disagreed about the active org in the same directory.

hm cloud org switch deliberately keeps Config::load(None) — it's a load-mutate-save on the user file, and merging the project layer would persist project-scoped values into ~/.config/hm/config.toml. Commented in place.

Pre-existing wrinkle left alone: Config::load merges env, so HM_API_URL=x hm cloud org switch y still writes api_url=x to the user config.

5520183 — stop escaping RFC 3986 unreserved chars in secret names

0d2256d swapped SEGMENT for NON_ALPHANUMERIC, which also escapes - . _ ~. hm cloud secret rm DEPLOY_TOKEN was requesting /secrets/DEPLOY%5FTOKEN — a different resource than the user named. DEPLOY-TOKEN_v2.0~rc was mangled four ways.

Keeps that commit's win (30 hand-listed bytes gone) by deriving the set rather than enumerating it:

const SEGMENT: &AsciiSet = &NON_ALPHANUMERIC
    .remove(b'-').remove(b'.').remove(b'_').remove(b'~');

This also unbreaks the suite, red since 0d2256d. That commit renamed unreserved_name_is_not_encoded → special_chars_are_encoded and flipped its expectation to the escaped output, dropping the comment "RFC 3986 unreserved chars (incl. - _ . ~) must pass through" — the bug was written down as the spec. It left item_path_appends_encoded_name asserting the opposite, so the two tests contradicted each other and the suite could not pass either way.

---

Verification

206 passed, 0 failed — green for the first time since 0d2256d. Beyond tests, the behaviour was driven against the built binary: project-config layering in/outside a project and from nested subdirs; --dir exactness (a --dir at a non-workspace subdir returns the empty envelope rather than escaping upward); relative --dir; walk-up from subdirectories; and the hm run --dir divergence.

[markovejnovic]

Superseded by #168, which rebuilds this on main so the refactor can land independently of the secrets feature.

#167 was based on cli-41-secrets, so it could only merge after #152. #168 targets main directly and carries the same work minus two pieces that genuinely can't go to main — the raw_org_ctx → SecretString change and the percent-encoding fix — because verbs/secret.rs doesn't exist there. Those stay with #152.