feat(cli): use repository config for attestations

[waveywaves]

This PR starts the implementation of Spec 001: Project and Organization from .chainloop.yml in Attestations. It covers R-007 and R-008. The complete implementation is tracked in #3504.

Summary

• The attestation and trace commands now use one repository-config reader. It searches from the current directory to the Git repository root, prefers .chainloop.yml over .chainloop.yaml, accepts files without projectName, and returns the selected path (R-007).
• The existing trace config helpers use the shared reader instead of implementing their own file selection.
• attestation init reads projectVersion through the shared reader and continues normal flag validation when the config is missing or cannot be read (R-008).

Requirements covered

• R-007: One way to find the file
• R-008: Flag checks without a file

The remaining requirements and every implementation PR are tracked in #3504.

Refs #3063

AI assistance

pi helped to write this change. The commit carries an Assisted-by: pi trailer.

[chainloop-platform]

AI Session Checks — ⚠️ no AI session found

Missing AI Coding Sessions

This organization requires every PR to be backed by a Chainloop Trace AI coding session, and none was found for this one.

Please make sure the AI coding session evidence has been sent by the Chainloop CLI, or add the skip-ai-session label to this PR to bypass this check.

Learn more about Chainloop Trace.

---

Powered by Chainloop and Chainloop Trace