[aaltshuler]

Scope selection currently reads OMNIGRAPH_PROFILE inside the decision function, so identical explicit inputs can resolve differently depending on process state. Make scope::resolve_scope pure over the supplied configuration, flags, capability and ambient profile. Keep a thin resolve_scope_from_env wrapper at the six existing production call sites.

Preserve current precedence, refusal text, missing/empty/non-Unicode environment handling, and the distinction between an empty ambient profile and an explicitly empty profile name. Configuration loading, credentials, discovery and managed-context ambiguity checks keep their existing owners and order. No CLI syntax, dependencies or GQT changes.

This is the second refactor slice discussed in #675. It is based directly on main and can be reviewed independently of #1037.

Validation:

• Clean baseline: 20 scope unit tests and 5 focused integration tests passed.
• After extraction: the same 20 unit tests, with expanded cases, pass while the process has an invalid OMNIGRAPH_PROFILE, proving the pure tests use only supplied values.
• 7 integration tests pass, covering child-process environment handling, profile precedence, direct-store resolution, and existing managed ambiguity/direct-mode behavior.
• CLI Clippy (--all-targets --locked, warnings denied), formatting, documentation/link checks, spelling and git diff --check pass.

[aaltshuler]

Superseded by #1047, which merged the complete CLI refactor, its delivery and configuration fixes, and the latest main integrations as 02026b5. Closing this incremental slice because its implementation is now on main.