skill when to reach for the CLI

Mirrors the references/opencode/ layout. Both Kortix-side reference
docs now live in a sibling references/kortix/ folder under the
kortix-system skill. The CLI doc no longer ships at the project root
(.kortix/kortix-cli.md was cluttering things); it's entirely inside
the skill where the kortix-system reference framework picks it up.

Layout:
  .kortix/opencode/skills/kortix-system/
    SKILL.md
    references/
      kortix/
        kortix-toml.md   (was: references/kortix-toml.md)
        kortix-cli.md    (was: .kortix/kortix-cli.md)
      opencode/
        overview.md, agents.md, skills.md, commands.md, tools.md,
        plugins.md, mcp-servers.md, permissions.md, rules.md, models.md

SKILL.md changes:
  - New <cli> section. Tells the agent inside a sandbox that
    $KORTIX_TOKEN + $KORTIX_API_URL are already injected, gives a
    "user says X → run kortix Y" table for the common cases (secrets,
    sessions, triggers, change requests, deploys, whoami), and reminds
    the agent the token is project-scoped (so `kortix projects ls`
    deliberately 403s — use `kortix projects info` for self-inspection).
  - The two <reference path="…"> URIs point at the new locations.

Scaffold test updated to match the new file paths. Self-reference
inside kortix-cli.md (a doc that mentions its own location) updated
to its new home. CLI test suite still 3/3.