Set the parent of an existing team that has none

[parkerbxyz]

Fixes #309.

When an existing team had no parent, read_team copied the parent from the team's entitlement file into the team's current state. The provider diff and sync_team then saw no parent change, so the parent was never set and nothing was logged.

Changes

• API reads: the current state uses the parent GitHub reports, including nil. Other entitlement metadata is kept, and a nil metadata hash is handled.
• Cached reads: if the entitlement wants a parent and the predictive cache doesn't record parent_team_name, read_team reads the team from the API instead. A cache entry that records a parent is used as before. If it differs from the entitlement, the provider's existing diff flow refreshes it from the API.
• The existing rule that ignores removing a parent when the entitlement doesn't set one is unchanged.
• Acceptance fake API: it looked up the parent with a symbol key on string-keyed JSON, so it never reported a parent, and the team map stored "nil" as a string. The old read_team behavior hid both. The fake API now reports parents, and the modify-and-delete run checks the real child-team parent change from employees to grumpy-cat, which raises its change count from 28 to 29.

This doesn't change how update_team handles errors or how sync_team counts a failed parent update. That's tracked in #6.

Cache entries saved before this fix

Predictive cache snapshots are written from each team's declared metadata, so an entry can record a parent the team doesn't have. The plugin can't tell those entries apart. To correct affected teams, run Entitlements once with --full.

Tests

• Service specs for read_team: an API read for a team with no parent, an API read with no entitlement metadata, and cached metadata that's nil, has no parent key, records no parent, or records the parent.
• Provider specs that go through read_team, diff and commit for a parent-only change: with no cache, with a cache that doesn't record a parent, and with a cached parent that differs, both when the API has no parent and when it already has the desired parent. They also check that the API is read only once, that the update uses the real team ID, and that parent removal is still ignored.
• Seven of the new specs fail without the fix.
• script/test -d -k passes with 100% coverage, rubocop reports no offenses, and the acceptance suite passes in CI.