feat: add wso2 account rename <old> <new>

What to build

wso2 account rename <old> <new> renames an account the shell already holds. It matters more once a new account is named account-1 by default (#175): a numbered name carries no meaning, so a person who wants a meaningful one needs a way to give it after the fact rather than only at creation.

The rename changes the account's own name and repoints every context that names it, under the same lock every other mutating account command writes under. It does not touch the account's credentialRef, and so moves nothing in the secure store: the store cannot list its own entries, so an entry moved and lost could never be revoked afterwards. It also does not rename a same-named context — contexts are separate handles with their own create command — and the report says so, so a user is not left believing the context followed.

Refusals: an unknown account, a new name already taken by an account, and a name that is not a legal account name, each recovering the way the neighbouring account commands recover.

Acceptance criteria

• wso2 account rename <old> <new> renames the account and every context that pointed at it now points at the new name.
• The account's credentialRef is unchanged, and no secure-store entry is moved or removed.
• A same-named context keeps its old name, and the report says the context was not renamed.
• Renaming an account that does not exist is refused, and names how to see what exists.
• Renaming to a name another account already holds is refused.
• Renaming to a name that is not a legal account name is refused, and states the name rule.
• The command renders the same machine-readable result shape the rest of the wso2 account family renders, and honours --output json.
• docs/reference/commands.md has a wso2 account rename row beside account create, add-product and remove-product, and the command synopsis near the top of the file matches.

Blocked by

• None — can start immediately.

Start with the existing wso2 account command entry points and neighboring account commands to follow their locking, refusal, reporting, and machine-readable output conventions. Update docs/reference/commands.md alongside the named account commands, then verify the acceptance criteria: contexts are repointed without changing credential references, same-named contexts are reported unchanged, refusals are clear, and --output json matches the family shape.