fix(cli): keep permissioned_as on single-item push, as sync push does (#11000)

* fix(cli): keep permissioned_as on single-item push, as sync push does

* fix(cli): resolve syncBehavior from the target workspace, not the branch alone

* refactor(cli): share the workspace-name resolution between sync and single-item push

* test(cli): import the moved workspace-name helper from its new home