feat(cli): port orgs commands to native TypeScript

[Coly010]

Summary

Promotes supabase orgs list and supabase orgs create from Phase 0 Go-binary proxies to native TypeScript implementations in the legacy shell. The handlers reuse the shared infrastructure introduced by the branches port — HTTP error mapper, Go-compatible JSON/YAML/TOML/env encoders, and Glamour-rendered pretty tables — so no new shared helpers were needed.

Go source mirrored 1:1: apps/cli-go/internal/orgs/list/list.go and apps/cli-go/internal/orgs/create/create.go. Error templates, output mode behaviour, and the Created organization: <id> preamble byte-match the Go CLI.

Notable parity rules

• orgs list --output env is rejected with the byte-exact Go message --output env flag is not supported.
• orgs list --output toml wraps the array as [[organizations]] (Go uses a TOML envelope for arrays).
• orgs create --output env is supported here, unlike on list — matches Go's EncodeOutput flattening of a single object into ID=… NAME=… SLUG=….
• Created organization: <id> preamble fires before every Go-output mode (json / yaml / toml / env / pretty) but is omitted from --output-format json / stream-json, where the message is delivered as a structured event field instead.
• Telemetry flushes in Effect.ensuring on success and failure (CLAUDE.md PersistentPostRun parity rule). No linked-project cache write — these are user-level commands without a --project-ref.
• Parent description matches Go exactly: Manage Supabase organizations (no trailing period).

Tests

• 3 unit tests for renderOrgsListTable (header-only, multi-row, literal | passthrough).
• 32 integration tests covering every output mode for both subcommands, the env-not-supported rejection, --output-over---output-format precedence, network and HTTP-503 error paths (including the format !== "text" spinner-undefined branch), and telemetry flush on both success and failure.

E2E coverage deliberately omitted — these are pure Management-API CRUD commands with no subprocess-specific behaviour to validate (per CLAUDE.md testing policy).

Reviewer-relevant context

• The orgs handlers never resolve a project ref but still use legacyManagementApiRuntimeLayer, which constructs the project-ref resolver lazily. The orgs handlers simply don't yield those services. This is intentional: keeping a single shared runtime layer is cheaper than maintaining a user-vs-project layer split.
• orgs.errors.ts and orgs.format.ts are colocated at the family root, not hoisted to legacy/shared/. Per CLAUDE.md hoist-before-duplicate, the threshold is "used across ≥2 families" — branches has its own branches.format.ts/branches.errors.ts, and these are the second instance of the pattern, not yet a third.
• The Glamour table renders API-supplied strings (id, name) without ANSI/control-character stripping. This is strict Go parity — both SIDE_EFFECTS.md files document the deliberate pass-through under "Security Notes" so a future renderer-level sanitization fix has a clear pointer.

Refs CLI-1290.