--schema/NSC_SCHEMA override is cached as the profile's fresh schema and leaks into later runs #196

The override path in resolve_command_model (nsc/schema/source.py) runs _build_and_cache(loaded, paths, profile). That function saves the override's command model into the active profile's cache with record_fetch=True, which stamps a fresh fetched_at sidecar. Later runs without --schema then pick that model up as if it were the real NetBox schema:

• TTL fast-path (default schema_refresh: daily, also weekly/manual): for the rest of the TTL window, the override schema is served with no fetch and no warning, even when NetBox is reachable.
• Offline fallback (any policy): _find_any_cached picks the newest entry by mtime, so an unreachable NetBox serves the override schema ("using cached schema").

This matters more now that NSC_SCHEMA is honored as an override (#192), since an exported env var hits this on every run.

Repro (widgets.json = minimal schema with only /api/dcim/widgets/; NetBox unreachable at http://127.0.0.1:1):

export NSC_HOME=$(mktemp -d)   # default schema_refresh: daily
nsc --url http://127.0.0.1:1 --token x --schema ./widgets.json dcim widgets --help   # exit 0, expected
nsc --url http://127.0.0.1:1 --token x dcim widgets --help                          # exit 0, silently uses the override

With schema_refresh: on-hash-change, the second command prints Could not reach NetBox ...; using cached schema. and also serves the override.

Expected: an override never becomes the profile's cached schema. Options:

• don't persist override models;
• persist them under a separate namespace keyed by source;
• persist with record_fetch=False and exclude them from _find_any_cached.

An override whose hash matches an existing profile entry should also not touch_fetched_at it.

Found in review of #193.