Add apply command to copy portable org state between instances

[andredlng]

Depends on datamesh-manager/entropy-data#1521 — that app PR adds GET/PUT /api/organization/features, which this PR's organization-features resource requires. It must be merged and deployed before apply can copy organization features to a target instance. The rest of this PR works against the current API and is independent of #1521.

Summary

Adds a new apply command (plus supporting export/import dir work) that copies an organization's portable, declarative state from one Entropy Data instance to another — e.g. promoting a test environment's setup to production.

entropy-data export dir <path>  -c <source>                 # enumerate a source into a local YAML tree
entropy-data import dir <path>  -c <target> [--prune]       # upsert a tree into a target (zip form unchanged)
entropy-data apply --source <conn> --to <conn> [--prune] [--dry-run] [--keep <dir>]

• apply exports the source into a staged directory and imports it into the target, so the transfer produces an auditable, re-runnable artifact. Supports --prune, --dry-run (per-resource create/update/prune counts), --include/--exclude, and --keep <dir> to retain the staged export. --source defaults to the global -c/--connection; --to is the required target.
• export dir (new) enumerates a source into a local YAML tree, mirroring the app's organization-export layout so artifacts interchange.
• import gains an import dir subcommand alongside import zip (the zip form now extracts to a temp dir and reuses the same engine). Both gain --prune (deletes target resources absent from the import, reverse dependency order, confirmation-gated unless --yes) and --include/--exclude.
• Fix: import silently dropped sourcesystems/ from an org export — now imported in its correct dependency position (after policies, before assets).
• Copies teams, tags, definitions, policies, sourcesystems, certifications, classification-schemes, assets, datacontracts, dataproducts, example-data, access, the semantics graph (namespaces + concepts/relationships nested per namespace), and the organization feature configuration (singleton).

One shared resources.py/sync.py engine drives export, import and apply so they cannot drift, with three resource shapes:

• Flat — /api/{path} list + /api/{path}/{id}; artifact <name>/<id>.yaml.
• Nested (semantics) — a {parent} api_path template enumerated per parent; artifact <name>/<parent>/<id>.yaml; imported parent-first, pruned per parent.
• Singleton (organization-features) — one object at /api/{path} (no id, no list); artifact <name>/<name>.yaml; applied last so a restrictive managedTagsPolicy it carries cannot reject earlier imports; never pruned.

All writes are idempotent PUT-by-id (or PUT-to-path for the singleton); the run is continue-on-error with a per-resource summary and non-zero exit on any failure.

Testing

ruff check/ruff format clean; pytest — 276 passed (25 in the export/import/apply suite, covering flat + nested semantics + singleton export/import/prune, upsert ordering, prune reverse-order + absent-only, apply orchestration, and the sourcesystems fix).

Notes / out of scope

• dataproductbuilder is intentionally not wired yet — it needs an app-side schema migration to add a stable externalId before it can get an externalId-keyed API.