3.8.1

discover, reworked around how SSO actually behaves

g3dt config discover <aws-profile> is now the recommended flow: it checks
that profile's SSO session first, offers to run aws sso login right
there, then scans that one account for deployed /{project}/{env}
environments — no more sweep output that is mostly "go log in N times".

• Findings are deduplicated when several profiles see the same account
  (e.g. a default alias) — one suggestion/registration per context, first
  profile wins.
• --all-profiles remains for the opt-in full sweep (stale sessions are
  skipped with a login hint, never logged in automatically).
• Guidance strings and docs updated to the single-profile flow.