feat: alias variables with {{name}} placeholders

[sassman]

Closes #103.

What

Named variables that substitute into alias commands as {{name}}. Set once with am var set, scoped local / profile / global. Variables resolve scope-locally — an alias only sees vars defined at its own scope.

am var set -l opts "-C opt-level=3"
am add -l r 'RUSTFLAGS="{{opts}}" cargo run --release'

Why

Recurring command fragments (compiler flags, paths, version numbers) were duplicated across aliases. Vars factor them out without inventing a new alias-of-aliases pattern. Set once, edit one place, sync rebuilds everything.

Working forms of the example alias

The same alias body can be expressed several shell-quoting ways. All of these end up with the alias body RUSTFLAGS="{{opts}}" cargo run --release --bin am (or the '-variant) and produce a working fish function after am sync:

# A. outer ' , inner "  — most readable
am add -l r 'RUSTFLAGS="{{opts}}" cargo run --release --bin am'

# B. outer " , inner '
am add -l r "RUSTFLAGS='{{opts}}' cargo run --release --bin am"

# C. outer " , escaped inner \"
am add -l r "RUSTFLAGS=\"{{opts}}\" cargo run --release --bin am"

# D. no outer wrap (clap's trailing_var_arg + shell escaping)
am add -l r RUSTFLAGS=\"{{opts}}\" cargo run --release --bin am

A bare-unquoted {{opts}} parses but breaks at runtime if the value contains whitespace — that's expected shell semantics, the user picks the quoting:

# E. won't run if the value has spaces
am add -l r 'RUSTFLAGS={{opts}} cargo run --release --bin am'

Behavioural notes

• Vars are literal text, not shell-expanded — '{{opts}}' substitutes to '-C opt-level=3' (one token), not ''-C opt-level=3'' (two empty strings + bare flag).
• Aliases referencing an undefined var emit a warning and are skipped from the sync, not silently broken.
• am var set/unset triggers a sync via the shell wrappers, so dependent aliases come alive immediately.
• am var set <name> <value> accepts hyphen-leading values like -C opt-level=3 (clap allow_hyphen_values).

Side-effect cleanups landed in this PR

• Bin's local-mutation helpers (add_local_alias etc.) now go through a shared upsert_local_aliases / mutate_existing_local pair — six near-clones collapse to ~5 lines each. Fixes a dead-code identity branch and an inconsistent missing parent-prompt.
• Bin's local writes now refresh the security trust hash via AppModel::refresh_project_trust_at, matching the lib path used by am-tui and tests. am add -l ... no longer leaves the hash stale.
• All scope-flagged commands (add / remove / var) share one TargetScopeArgs clap struct.
• All alias / subcommand / var handlers in update.rs now go through resolve_target + get_profile_mut — ~130 lines of repeated dispatch ladders gone.
• Fish's complete --wraps target skips KEY=value env-var prefixes (with quote-aware values) — fixes the parse-error cascade where RUSTFLAGS="-C opt-level=3" cargo run produced complete -c r --wraps "RUSTFLAGS="-C".
• update::InitShell now routes its output through Effect::Print instead of an inline print!, one step closer to a fully pure update().