fix: propagate 403 from multi-region fan-out instead of returning empty list (CLI-89) (#507)

## Follow-up to PR #498

Addresses two missed review comments:
- [Sentry Bot
(CRITICAL)](#498 (comment)):
The enriched 403 error is silently caught in the multi-region fan-out
- [Cursor
Bugbot](#498 (comment)):
`filter(Boolean)` removes blank line separator (already fixed in PR
#498's second commit)

Also fixes the low patch coverage (~35%) from PR #498 by adding 3 tests.

## Problem

PR #498 added helpful token-scope guidance to 403 errors from
`listOrganizationsInRegion`. But `listOrganizationsUncached` wraps the
region calls in `try { ... } catch { return []; }`, silently swallowing
the enriched error. On SaaS (multi-region), users with a token lacking
`org:read` scope would get an empty org list instead of the guidance
message.

## Fix

Changed the multi-region fan-out from `Promise.all` + try/catch to
`Promise.allSettled` with explicit error tracking:

- **Transient failures** (network, 5xx): still swallowed per-region —
one region's outage shouldn't block others
- **403 errors**: tracked; if **all** regions fail with 403, the
enriched error is re-thrown so users see the scope guidance
- **Partial success** (some regions 403, others OK): returns available
orgs from successful regions

## Tests Added

| Test | What it covers |
|------|---------------|
| `enriches 403 error with token scope guidance` |
`listOrganizationsInRegion` adds `org:read` hint to 403 errors |
| `propagates 403 error when all regions return 403` | Fan-out re-throws
enriched 403 when no region succeeds |
| `returns partial results when some regions return 403` | Fan-out
returns orgs from healthy regions, swallows per-region 403 |

Author: BYK