feat(cli): bind --profile as a root-level global flag

Summary

--profile selects the API-key profile but is only bound on some commands. Telemetry (5.x, 14 days): 86 distinct installs passed --profile to 75 commands that do not define it (apps list 31, auth status 18, …) and got unknown-flag errors.

Proposed fix

Bind --profile at the root FlagSet (as --output/--api-debug are) so it is accepted before or after the subcommand on every command, with the same semantics as today's per-command flag; remove the per-command duplicates if they become redundant. Note the @env:/@file: indirection PR (#2585) excludes root-owned --profile; keep that exclusion.

Acceptance criteria

• asc apps list --profile X and asc --profile X apps list both resolve the profile
• existing per-command --profile behavior unchanged; help regenerated