feat(cli): universal trailing --dry-run option propagation across subcommands

[dan-petty]

Problem

When users run subcommands with trailing --dry-run (e.g. devops repos sync --dry-run or devops tf apply --dry-run), the top-level Click callback in main.py receives dry_run=False (since --dry-run occurred in the subcommand position) and executes set_dry_run(dry_run), overwriting the global dry-run state previously activated by entry.py. Furthermore, _lazy_proxy in src/devops_cli/core/cli.py only checks is_dry_run(), failing to detect --dry-run in ctx.args, and delegates the raw flag to target module apps where Click throws Error: No such option: --dry-run.

Proposed Solution

1. In src/devops_cli/main.py: Guard set_dry_run(True) so that main() never resets active dry-run state when dry_run is False.
2. In src/devops_cli/core/cli.py: Enhance _lazy_proxy to detect trailing --dry-run in ctx.args, strip it, set global dry-run state, and execute the simulated dry-run output cleanly.
3. In src/devops_cli/commands/repos.py: Expose explicit --dry-run option on sync / update so that directly invoked app instances also support --dry-run.
4. Add comprehensive test coverage in tests/test_all_commands_help_dryrun.py and tests/test_main_dry_run.py verifying leading and trailing --dry-run across subcommands.