3.8.0

Contexts: one obvious answer to "what am I pointed at?"

A context is a named (project, env, profile, region) tuple. The command
surface reads as plain English (design doc: docs/design/contexts.md):

g3dt config discover --all-profiles --add   # find deployed infra, register it
g3dt config contexts                        # list them (current marked *)
g3dt config use acdc/staging                # act there from now on
g3dt --ctx acdc/prod <command>              # one-shot override

• Universal banner: every command prints the resolved context first (on
  stderr — eval $(g3dt config dbt-env ...) stdout stays clean).
• Production guards: prod contexts are marked [PROD]; switching to one
  asks for confirmation; destructive actions require typing the context name;
  --yes never bypasses a production prompt.
• Full back-compat: legacy markers (project/default_env/profiles), the
  3-key EC2 box marker, the file-less CodeBuild path (G3DT_PROJECT + --env),
  and the --env <base>_ec2 dispatch wire form all behave identically.
  config show/diff/dbt-env default to the current context; --env selects
  the matching context everywhere. config set is deprecated (hidden); the
  LLM key path moved to g3dt synth set-key <path>.

Fixes

• upload-all: ModuleNotFoundError 'g3dt' on the EC2 box — wrapped shell
  scripts now receive the CLI's own interpreter (G3DT_PYTHON); bare python3
  on AL2023 is 3.9 while g3dt installs under 3.11.
• metadata upload: empty submission results fail fast with the real
  per-chunk errors instead of retrying an impossible empty receipts write (#14).
• config show --full / config diff no longer try a laptop profile for
  _ec2 envs (latent ambient-credentials bug).
• config envs lists across all of a project's accounts instead of
  authorizing with an arbitrary first profile.
• synth install-simulator upgrades instead of install-once.