feat(control-plane): add org/project get+delete and repo grant list+remove

Consume the v1 CRUD-gap endpoints (entiredb #2122):

• entire org get|delete <name|ULID>
• entire project get|delete <name|ULID>
• entire grant repo list <repo>
• entire grant repo remove <repo> (--provider/--provider-user-id or --grantee-type/--grantee-id)

Org/project args resolve friendly names via the shared resolveref helpers. The grantee-mode helper (renamed parseGranteeMode) and the provider/by-id remove form are now shared by project and repo. Repo args stay ULID-only for now — resolving a repo by name needs a project scope.