refactor(commands): split apply.go per-file dispatch and tighten error wraps

apply() loses its unused args parameter (Args is cobra.NoArgs anyway)
and pulls ctx from cmd.Context() so contextcheck stays clean. The
per-file body splits into applyOneFile / applyOneFileTemplateMode /
applyOneFileDirectPatchMode plus a buildApplyClosure helper, taking
the gocognit and nestif gates back under the linter's threshold
without changing observable behaviour. The applyTemplatesPerNode and
withApplyClient signatures stay byte-for-byte identical because tests
inject through them; cosmetic renames (f → action) only touch
internal parameter names.

Errors:
- engine.NodeFileHasOverlay now wraps via errors.Wrapf instead of
  passing through bare, so the propagated error keeps an
  operator-facing trail.
- WithHint / WithHintf returns get nolint:wrapcheck because
  cockroachdb's WithHint is wrapcheck's blind spot — the inner
  errors.Wrap already carries the cause, WithHint only attaches a
  hint chain.
- forbidigo nolints attached to the user-facing CLI progress lines.
- gochecknoglobals nolints on the cobra command and flag struct.
- Hoisted the recurring '..' literal to a parentDir const so goconst
  has a single canonical reference.
- Embedded helpers.Mode now sits above a blank line per
  embeddedstructfieldcheck.

Signed-off-by: Aleksei Sviridkin <f@lex.la>

Author: lexfrei