tcfeed: accept pr --apply as the spelling of pr --all

[ralyodio]

Summary

• tcfeed pr --apply now means exactly what tcfeed pr --all means: the last scan's table, worst first, same caps.
• The pit alias runs it as /tcfeed pr --apply, the word the other house tools use for "do it" (gh-prs-merge-all --apply), and a usage error over the spelling helps nobody.
• Usage text and the header comment name the synonym.

Verified

• tcfeed pr --apply with an empty cache answers "no last run to take" (the --all path).
• tcfeed pr --apply foo/bar is refused as ambiguous, as --all foo/bar is.
• The feed this was typed for is registered on the box: tcfeed rss add 'https://nichedb.dev/api/v1/items?source=npm&limit=200' gives 67 repositories from one fetch, and a scan reported "67 from 1 feed".

🤖 Generated with Claude Code

[github-actions]

ThreatCrush Security Scan

12 finding(s)

HIGH/CRITICAL: 1 | MEDIUM: 6 | LOW: 5

Severity	Rule	Location
HIGH	secret-aws-access-key	prd/0003-detect-hardcoded-secrets-before-they-are-committed-or-served.md:126
MEDIUM	js-open-redirect	apps/web/src/app/auth/login/page.tsx:50
MEDIUM	js-unescaped-html-sink	apps/web/src/app/hire/page.tsx:104
MEDIUM	js-unescaped-html-sink	apps/web/src/app/hire/page.tsx:108
MEDIUM	js-open-redirect	apps/web/src/components/funding/FundingClient.tsx:97
MEDIUM	js-unescaped-html-sink	apps/web/src/components/GuideReader.tsx:265
MEDIUM	js-uninitialized-buffer	packages/scan/src/node-rules.ts:456
LOW	secret-generic-credential	PRD.md:269
LOW	tls-verification-disabled	prd/0004-find-dangerous-code-patterns-without-pretending-to-be-a-compiler.md:121
LOW	tls-verification-disabled	prd/0004-find-dangerous-code-patterns-without-pretending-to-be-a-compiler.md:122
LOW	sh-remote-script-execution	scripts/smoke-test.sh:47
LOW	secret-aws-access-key	scripts/smoke-test.sh:112

Snippets are redacted; ThreatCrush never prints matched credential material.