Adopt ConfigKit overlays for pipeline selection

docs/cli.md

@@ -44,7 +44,7 @@ Most session-aware commands accept:
 - `--session <session.yml>`
 - `--session-id <session_id>`
 - `--previous-session-id <session_id>`
-- `--profile <name>`
+- `--overlay <name>`
 - `--secrets-dir <directory>`
 
 Rules:
@@ -54,9 +54,9 @@ Rules:
 - if both positional `<session_id>` and `--session-id` are provided, values must match.
 - `--previous-session-id` is a strict expectation: the selected session file
   must contain the same `previous_session_id`.
-- `--profile` selects `profiles/<name>.yml` relative to the pipeline root. It
+- `--overlay` selects `overlays/<name>.yml` relative to the pipeline root. It
   may be supplied once; omitted, empty, and the exact name `default` select the
-  base configuration, while an unknown named profile fails. The same selection
+  base configuration, while an unknown named overlay fails. The same selection
   applies to all common-flag commands, including `regenerate-artifacts`.
 - `--secrets-dir` selects ConfigKit credential-file bootstrap explicitly. A
   relative value uses caller CWD. Without the flag, a present `secrets/`
@@ -85,14 +85,14 @@ Commands with additional positionals keep their command-specific order:
 ### `config validate`, `config show`, `config sources`, `config artifacts`, and `config diff`
 
 ```bash
-narratio config validate [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--profile <name>] [--secrets-dir <directory>]
-narratio config show [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--profile <name>] [--secrets-dir <directory>]
-narratio config sources [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--profile <name>] [--secrets-dir <directory>]
-narratio config artifacts [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--profile <name>] [--secrets-dir <directory>]
-narratio config diff <left-profile> <right-profile> [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--secrets-dir <directory>]
+narratio config validate [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--overlay <name>] [--secrets-dir <directory>]
+narratio config show [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--overlay <name>] [--secrets-dir <directory>]
+narratio config sources [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--overlay <name>] [--secrets-dir <directory>]
+narratio config artifacts [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--overlay <name>] [--secrets-dir <directory>]
+narratio config diff <left-overlay> <right-overlay> [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--secrets-dir <directory>]
 ```
 
-These commands resolve the selected profile, defaults, ordinary paths, and—if
+These commands resolve the selected overlay, defaults, ordinary paths, and—if
 a campaign is selected—the campaign-owned party. They neither discover or load
 a session nor create a workspace, manifest, run, lock, adapter, or remote
 connection. Like every pipeline-loading command, they bootstrap the selected or
@@ -107,7 +107,7 @@ configured default campaign so Narratio can expand its concrete artifacts and
 publish rules. `--campaign` and `--campaign-file` remain mutually exclusive.
 Session, range, force, and artifact-execution flags are not accepted.
 
-`config validate` writes a concise root-path, selected-profile (or `none`), and
+`config validate` writes a concise root-path, selected-overlay (or `none`), and
 effective-digest summary after successful complete validation. `config show`
 writes one deterministic, secret-free YAML document containing defaulted and
 expanded concrete configuration. It omits ConfigKit directives, artifact
@@ -115,9 +115,9 @@ family declarations, and runtime provenance.
 
 `config sources` reports the same fully validated resolution without printing
 effective values. Its header identifies the root, ordered imports, selected
-profile and overlay, selected campaign, party source, and digest. The
+overlay and its file, selected campaign, party source, and digest. The
 remaining tab-separated records are sorted as `path`, `role`, and `source`.
-Roles distinguish root, import, profile, centralized default, campaign, party,
+Roles distinguish root, import, overlay, centralized default, campaign, party,
 and generated family ownership. A generated party member has
 one family record and one party record at the same logical path. The output
 never reads or prints secret values.
@@ -133,14 +133,14 @@ party-driven families retain the campaign requirement. See
 [Scriptorium Artifact Entries](./config.md#scriptorium-artifact-entries) for the
 configuration layout.
 
-`config diff` resolves both supplied profile names independently and compares
+`config diff` resolves both supplied overlay names independently and compares
 their fully resolved, secret-free effective mappings. It does
-not accept `--profile`; the two positional names must be distinct, declared
-profiles. When party-driven families are present, both profiles must resolve to
-the same selected campaign and party. Use `--campaign-file` if profile-specific
+not accept `--overlay`; the two positional names must be distinct, valid
+overlays. When party-driven families are present, both overlays must resolve to
+the same selected campaign and party. Use `--campaign-file` if overlay-specific
 campaign configuration would otherwise select different files.
 
-Equal profiles print `no differences`. Otherwise, sorted tab-separated records
+Equal overlays print `no differences`. Otherwise, sorted tab-separated records
 use one of these forms, with compact JSON values:
 
 ```text
@@ -151,7 +151,7 @@ changed  <path>    <left-value>    <right-value>
 
 Mappings are flattened to their logical field paths; lists remain one atomic
 value. The command compares defaulted concrete artifacts and publish rules, not
-profile names, source-file layout, or formatting. It succeeds when differences
+overlay names, source-file layout, or formatting. It succeeds when differences
 are found, making it suitable for review and migration checks.
 
 ### `version`
@@ -189,7 +189,7 @@ Behavior:
 - writes the session manifest as the sole durable progress ledger. Each
   invocation also creates its run-local directory and returns an immediate
   command summary; neither creates another durable progress record.
-- reports the resolved profile (or `none`) and effective configuration digest.
+- reports the resolved overlay (or `none`) and effective configuration digest.
 
 When `--artifacts` is present, the selected range must contain `analyze` or
 `publish`. Either consumer is sufficient, including a one-stage range.
@@ -304,7 +304,7 @@ Uses the same inclusive bounds, endpoint validation, force scope, and artifact
 selection contract as `run`. It validates config and prints run/skip decisions
 for selected stages only without creating the local workdir or changing the
 manifest. Resume-capable selected stages are checked against durable evidence.
-The output includes the resolved profile (or `none`) and effective configuration
+The output includes the resolved overlay (or `none`) and effective configuration
 digest without writing provenance or any manifest state.
 For `analyze`, the preview also lists explicit targets, prerequisite-only work,
 execution order, and reusable current artifacts with concise reasons. These