feat: replace --ref with global --profile selector #28

Summary

Replace the public per-invocation --ref <service>/<profile> selector with one inherited global --profile <name> selector in both gro and grw. This is a breaking CLI change: --ref must be rejected as unknown. Keep credential refs internal and preserve environment-over-config precedence, init guidance, and set-credential migration safety without saving one-shot profile selection to config.

Acceptance criteria

• gro mail search "hello" --profile rstockbower, gro set-credential --profile rstockbower ..., and gro init --profile rstockbower use google-readonly/rstockbower.
• grw --profile <name> qualifies the name with its own registered default service.
• Bare profile names use the existing credstore validation rules and fail before keyring or API access.
• Selection flows through the existing keychain override, retaining precedence: --profile > <SERVICE>_CREDENTIAL_REF > config credential_ref.
• init reports the qualified target and uses --profile in guidance without changing the active config.
• set-credential uses the inherited selector and keeps migration behavior centralized in keychain.Open().
• Public help/docs and ref-source labels say --profile; internal credential refs, config fields, environment overrides, and JSON ref fields remain unchanged.
• Set version.txt to 2.0 and update stale local release documentation.
• Cover both binary identities, validation, inherited command-tree behavior, init guidance, set-credential targeting, and rejection of public --ref in tests/checks.