Support app branches in sandbox commands

[theunreal]

Summary

• make --branch-id <id> global and forward it through all seven sandbox commands
• reject unsupported commands and empty branch IDs explicitly instead of silently targeting main
• preserve existing behavior when the flag is omitted

Scope

Branch support is currently sandbox-only. functions pull/list read the app-level deployed-function map; merely passing a branch query parameter is not sufficient. They now reject explicit branch scope, as do other unsupported commands. There is no entities pull command in this CLI; use sandbox file reads for branch source files. Full branch-aware resource pull support remains separate backend/CLI work.

Testing

• CLI production bundle build and TypeScript typecheck
• sandbox + functions pull/list: 47 tests passed (mocked HTTP, no live E2E)
• Biome lint/format and git diff --check

Coordination

Pairs with base44-dev/apper#23840 for the sandbox-based local-agent handoff. The CLI can release first: the old backend rejects branch-scoped sandbox payloads rather than ignoring them, and commands without the flag are unchanged.

[carmelc]

I am wondering if only the the sandbox cli commands need it, like don'tfunctions pull/entity pull (get the backend code and entity schemas) need the branch id too (I am not sure if it is covered in the feature), if it is relevant in more commands you can consider adding it to packages/cli/src/cli/program.ts (global params added to all cli commands)

[theunreal]

Good point, I made --branch-id global. sandbox commands support it, while unsupported commands like functions pull explicitly reject it instead of silently targeting main.