live: drive --live/--overlay from the render path (not just --ir)

[lex00]

Gap

The driven path (pinhole render ./project) graphs source only — graphFlags never passes --live/--overlay. pinhole can already render a realized-footprint IR if you hand it one via --ir (it reads groups.byContainer from chant graph --live), but it won't acquire it.

Want

Pass --live/--overlay through to chant so the driven path can paint the realized footprint directly:

pinhole render ./project --live --env prod            # provisioned graph
pinhole render ./project --live --env prod --overlay   # declared vs provisioned

Add the flags to GraphOptions/graphFlags (mirror the existing --env), shelling chant graph --format ir --live [--overlay] --env <name>.

Acceptance

• --live --env <name> renders the provisioned IR (nodes + reconstructed edges + containment).
• --overlay renders the classified graph (see companion issue for status rendering).
• Source path unchanged when the flags are absent.

Context

Stepping stone toward the behold live control plane (external concept), which will drive chant directly for data — but standalone pinhole users benefit from live rendering without hand-capturing an --ir file.