Workspace-scoped override properties not applied

## User Impact

When using an environment override file (e.g., `configuration.prod.yaml`) with workspace-scoped overrides like this:

```yaml
workspaces:
- name: my-workspace
properties:
description: "Production workspace"
apis:
- name: my-api
properties:
serviceUrl: "https://prod.example.com"
backends:
- name: my-backend
properties:
url: "https://prod-backend.example.com"
```

The CLI **applies overrides to the workspace container itself** (the `properties` on the workspace entry), but **silently ignores all nested child overrides** (apis, backends, loggers, etc. within the workspace). Customers migrating from the APIOps Toolkit who use workspace-scoped overrides will find that their workspace child resources are published with dev/staging values instead of the expected production values.

## Technical Details

The APIOps Toolkit resolves overrides using a parent chain — when publishing a resource scoped to a workspace (e.g., workspace API `my-api` in workspace `my-workspace`), it walks the override config: `workspaces → my-workspace → apis → my-api → properties`.

The CLI currently:
- **Parses** workspace child override sections correctly in `config-loader.ts` (nested entries under workspaces are stored in `OverrideEntry.children`)
- **Never applies** them — `override-merger.ts` doesn't check `descriptor.workspace` to determine if a resource is workspace-scoped, and doesn't look into workspace entry children for the override

## Expected Behavior

When publishing a workspace-scoped resource, the override merger should:
1. Check if the resource's descriptor has a `workspace` field set
2. If so, look up the workspace in the `workspaces` override section
3. Navigate into that workspace's children to find the appropriate override for the child resource type and name
4. Apply the override properties via deep merge

This should work for all workspace child types (apis, backends, diagnostics, groups, loggers, namedValues, policyFragments, products, subscriptions, tags, versionSets) including nested API sub-resources (workspace api → diagnostics, operations, policies, releases).

## Related

This was identified during the filter/override format alignment work in #114 / PR #115.