chore: drop the compatibility shims nobody is using

[dev-bap]

chore: drop the compatibility shims nobody is using

Two shims kept for users who do not exist yet, plus a wording fix.

The tool has no installed base. That is the window in which removing a
compatibility path costs nothing, and it does not stay open: every one of these
gets more expensive to remove the day somebody depends on it, and none of them
gets cheaper to keep.

The per-tool cookie variable

When the suite was a set of standalone binaries, each read its own
RBX<TOOL>_COOKIE. Folding them into rbx <subcommand> unified those to
RBX_COOKIE. One survivor was kept, on the argument written into its own doc
comment: removing a variable that works today would break whoever set it.

Nobody set it. What it cost:

• a branch in GlobalFlags::resolve_cookie, the chain that resolves a
  full-account credential, where the ordering between explicit sources,
  --no-auto-cookie and Studio auto-detection is already subtle enough to have
  produced fix(ban): list honours --limit, and the walk cannot spin #20;
• the one entry in STILL_READ, the exception list in
  tests/env_var_names.rs. That check now has no exceptions, which is the
  state an exception list should be in: one entry invites a second.

Two #[allow(unsafe_code)] go with it. They existed because the tests set the
variable, and set_var is unsafe under the 2024 semantics. Both test modules
now work off the thread-local Studio seam instead, so the allow would only be
sitting there permitting the next set_var to come back.

The one thing this cost

The variable was the only cookie source reachable from outside rbx-core,
which made it the only way to write a test distinguishing resolve_cookie()
from the raw --cookie flag. rbx-import used it for exactly that: meta_gaps
decides whether to tell the user "re-run with --cookie" for fields the meta
step may have just read correctly, and keying that off the flag alone told
everyone with Studio signed in to redo finished work.

So meta_gaps now takes the resolved cookie rather than the flags to resolve it
from:

fn meta_gaps(cookie: Option<&str>, domains: &[Domain]) -> Vec<Gap>

The distinction it got wrong once moved to its single call site, where it reads
env_global.resolve_cookie().as_deref() and re-introducing the bug means
writing env_global.cookie on a line that plainly looks wrong. The test is
total instead of illustrative: both inputs, no privileged source.

rbx data delete and restore

0.7.0 renamed these to delete-key and restore-key, so the level would be in
the name beside delete-store and restore-store. Its own doc comment says
why: delete Player_156 and delete-store PlayerData are one glance apart in a
shell history, and only one of them is recoverable by re-running the game.

Then it kept the old spellings as aliases, which held open the exact ambiguity
the rename existed to close, on the one pair of subcommands here where reading
the wrong level destroys the wrong thing.

The test that pinned the aliases is inverted rather than deleted: an alias is
one attribute and comes back by reflex, so a bare delete that parses should
fail a test.

download's "legacy"

A doc change only. --source public was documented as "the legacy
assetdelivery.roblox.com endpoint". The word was about Roblox's older host,
but on the default backend it reads as a deprecation notice. It is the
default precisely because it reaches more assets than Open Cloud does, and
neither is going away.

What is deliberately not here

rbxplace.toml gets no version key and no lockfile, and the lockfile
version-and-refusal machinery in rbx-core/src/lockfile.rs stays exactly as it
is despite its migration registries being empty.

Those registries are empty on purpose, and the asymmetry is the point:

• Refusing a file from a newer build has to ship before there are users,
  because it runs in the version already installed. A build that meets a
  version it does not understand and reads it anyway drops state in silence.
• Migrating can wait until there is something to migrate.

rbxplace.toml is the other kind of file: hand-written, in git, with comments.
Its version check is per-key rather than per-file (unknown_keys warns and
names the key being ignored), which is both more precise and the only thing
that works when one developer upgrades before their teammates. A regenerable
file gets a number and a refusal; a hand-authored one gets detection and a
warning.