bug: make quick CLI declaration transactional

[codeforester]

Summary

• snapshot the target CLI model before applying table rows and restore it on every late semantic failure
• remove every partial target-model entry when a new declaration fails
• validate enum shape and default membership during declaration, and localize the remaining multi-positional scratch array
• cover model, command, option, positional, alias, enum, boolean, and validator-name rollback failures

Validation

• shellcheck -S error lib/bash/cli/lib_cli.sh lib/bash/cli/tests/lib_cli.bats
• bats lib/bash/cli/tests/lib_cli.bats (17 tests)
• tests/compatibility-matrix.sh
• tests/artifact-contract.sh (isolated retry after an unrelated transient process-group failure)
• ./tests/validate.sh (clean rerun: 573 tests plus all extended gates)

Impact

• Public API: base_cli_declare is now transactional; enum defaults outside the declared enum are rejected with usage status 2
• Compatibility: rollback uses Bash dynamic scope, not namerefs or eval, preserving Bash 4.2 support
• Documentation: changelog entry only
• Demo and security: no changes required

Fixes #347