workspace configure: require explicit --apply flag before mutating repos

[codeforester]

Problem

basectl workspace configure applies GitHub settings and branch-protection changes across all workspace repos at once. A misconfiguration in the workspace manifest propagates everywhere simultaneously. There is currently no friction between "I edited the manifest" and "all repos are now reconfigured."

This is a high-trust, coarse-grained command: a single bad YAML value can cascade across ten or more repos with no undo.

Proposed solution

Make --dry-run the default mode. Require an explicit --apply flag to actually mutate repos:

basectl workspace configure            # dry-run: prints what would change, no mutations
basectl workspace configure --apply    # applies changes across all workspace repos

The pre-flight output should clearly list: which repos will be affected, what settings will change, and the current vs. proposed value where available. Model this on how basectl setup --dry-run is already implemented, reusing its patterns.

For scripted use, --apply --yes (or equivalent) should bypass any interactive confirmation.

Acceptance criteria

• workspace configure without --apply performs no mutations and prints a dry-run summary.
• Pre-flight output lists: affected repos, settings changing, current vs. proposed values where available.
• --apply flag triggers actual mutations (same behavior as current default).
• --apply --yes bypasses interactive confirmation for scripted use.
• Help text updated to clearly document the new default.
• docs/ updated to reflect the behavior change.
• Existing tests updated; new tests confirm: no mutation without --apply, correct mutation with --apply.