feat(cli): @env: and @file: value indirection for string flags

Summary

Any string flag value starting with @env:NAME resolves to that environment variable; @file:PATH reads the file (trailing newline trimmed); @@ escapes a literal leading @.

Motivation

Codemagic cli-tools supports this on every option (docs/app-store-connect/README.md in codemagic-ci-cd/cli-tools). asc only has ad-hoc --password-file / --identity-password-file. Agents drive ~48% of invocations; indirection keeps secrets and long text (release notes, JSON bodies) out of argv and transcripts.

Contract

• Implemented once at the shared parse layer with an exclusion list for flags that legitimately start with @; never for --output, --profile, or booleans.
• Unset/empty env or unreadable file -> usage error (exit 2) naming the variable/path.
• File reads follow the existing --*-file conventions (rootfs reasoning recorded in the design note).
• Telemetry never records resolved values.

Acceptance criteria

• unit tests per case (env, file, escape, errors)
• cmdtest end-to-end on a secret-ish flag and a long-text flag
• telemetry non-leakage test
• docs: concepts section, Global Flags in docs/COMMANDS.md, docs/design/flag-value-indirection.md

Partial work: worktree ~/Developer/CLIs/asc-flag-indirection (branch claude/flag-indirection-20260913).