fix(cli): env-aware config, pull clobber guard, strict overlays, 409 hint

Four review fixes on the `pic` surface:

- `config --effective` gains `--env`: it now resolves through the same
  overlay as `plan`/`apply`, so the masked report targets the app those
  commands act on instead of silently reading the base slug's secrets.
- `pull` gains `--force` and refuses to overwrite an existing
  `picloud.toml` (and colliding `scripts/*.rhai`) without it — fail-fast
  before any network call or write, mirroring `init`.
- Overlays (`ManifestOverlay`/`OverlayApp`) get `deny_unknown_fields`: a
  `[[scripts]]`/`[[routes]]`/`[[triggers]]` table or a typo'd key in an
  overlay now errors loudly instead of being silently dropped. +unit test.
- `apply` 409 (StateMoved — the only 409 the endpoint emits) surfaces an
  actionable hint (re-run `pic plan`, or `--force`) instead of a bare
  `HTTP 409`.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud-cli/src/main.rs

@@ -224,6 +224,9 @@ struct PullArgs {
     /// Directory to write `picloud.toml` + `scripts/` into.
     #[arg(long, default_value = ".")]
     dir: PathBuf,
+    /// Overwrite an existing `picloud.toml` (and colliding `scripts/*.rhai`).
+    #[arg(long)]
+    force: bool,
 }
 
 #[derive(Args)]
@@ -250,6 +253,10 @@ struct ConfigArgs {
     /// Show the effective (resolved) config with secrets masked.
     #[arg(long)]
     effective: bool,
+    /// Resolve against the `picloud.<env>.toml` overlay (per-env slug +
+    /// secrets), matching `pic plan --env` / `pic apply --env`.
+    #[arg(long)]
+    env: Option<String>,
 }
 
 #[derive(Subcommand)]
@@ -1151,8 +1158,10 @@ async fn main() -> ExitCode {
             .await
         }
         Cmd::Plan(args) => cmds::plan::run(&args.file, args.env.as_deref(), mode).await,
-        Cmd::Pull(args) => cmds::pull::run(&args.app, &args.dir, mode).await,
-        Cmd::Config(args) => cmds::config::run(&args.file, args.effective, mode).await,
+        Cmd::Pull(args) => cmds::pull::run(&args.app, &args.dir, args.force, mode).await,
+        Cmd::Config(args) => {
+            cmds::config::run(&args.file, args.effective, args.env.as_deref(), mode).await
+        }
         Cmd::Init(args) => cmds::init::run(
             &args.dir,
             args.slug.as_deref(),