bug: reject unreachable CLI routes

[codeforester]

Summary

• enforce sibling-wide uniqueness across canonical command names and aliases, including duplicate aliases in one declaration
• reject option names and tokens whose ancestor/descendant scopes overlap in either declaration order while allowing sibling reuse
• extend base_cli_validate_model to audit canonical routes, aliases, and effective option-token reachability
• apply the same rules to direct calls and table-driven declarations with order-permutation coverage

Validation

• shellcheck -S error lib/bash/cli/lib_cli.sh lib/bash/cli/tests/lib_cli.bats
• bats lib/bash/cli/tests/lib_cli.bats (21 tests on the merged bug: make base_cli_declare transactional when a late row is invalid #347 base)
• ./tests/validate.sh (577 tests plus all extended gates)

Impact

• Public API: previously accepted but unreachable CLI declarations now return usage status 2 before mutation
• Model validation: base_cli_validate_model now reports unreachable routes in addition to missing handlers
• Compatibility: Bash 4.2-compatible associative-array and string matching only
• Documentation: comments and changelog updated; no demo or security changes required

Fixes #350