[0xmc]

Summary

Listing a resource across all namespaces at organization scope is refused for every role, yet the get help recommended it and the refusal gave no next step.

The help example now lists across a project, and a refused org-wide listing prints a hint naming the project form and how to find project names.

Passing the org/project form that context listing prints as a project name now fails up front with a hint naming the bare project, instead of failing on discovery errors.

Test plan

• An org-wide listing across namespaces prints the refusal followed by the hint, in human and JSON error formats
• Project-scoped listings and org-scoped listings of organization resources print no hint
• An org/project value for the project flag or environment variable fails with a hint naming the bare project

Fixes #357

🤖 Generated with Claude Code

[ecv]

Approve.

The project-name check can only reject strings containing "/", which no valid project name has (names are Kubernetes object names), and it never rewrites or redirects scope: a rejected name stops before any request is sent. The new hint output is additive.

• Validation runs only for --project and DATUM_PROJECT; a project taken from the active context is not checked, so the org/project strings that ctx list prints cannot be mistaken for context-sourced values. The hint's suggested --project web matches the segment the user typed.
• main.go and root.go touch every command's fatal path only through FatalHint, which returns "" unless a get command at organization scope with -A recorded a hint. For JSON/YAML output, NewUserErrorWithHint(clean, "") renders the same envelope as the old plain error (empty code and hint, same message), so existing consumers see no change for other errors.
• The get -A hint is attached to any (Forbidden) fatal, not only the cross-namespace refusal. A genuine RBAC denial at organization scope with -A would also be told the list is "not allowed at organization scope", whatever the caller's role.

Follow-ups:

• Match the refusal's text (the tests already use "cross-namespace queries not allowed for organization-scoped requests") in FatalHint so an ordinary RBAC Forbidden gets no hint.
• The title says it rejects org names as well, but only --project is validated; --organization acme/web still goes through unchecked.
• getFatalHint is a package-level variable set by WrapGetCommand. That is fine for a one-shot CLI, but a test or embedder running two get commands in one process will see stale state.