refactor(cli): centralize declaration attribute allowlists

[codeforester]

Summary

Define one per-kind declaration attribute table and use it for imperative validation, quick-row validation, and runtime attribute propagation. This removes the duplicated option/positional allowlists while preserving declaration and parsing behavior.

Issue

Fixes #393

Validation

• git diff --check
• shfmt -d -ln bash -i 4 -sr lib/bash/cli/lib_cli.sh
• bats lib/bash/cli/tests/lib_cli.bats (28/28)
• env -u BASE_HOME BASE_CACHE_DIR=/private/tmp/base-bash-train-393 ./tests/validate.sh (616 BATS tests and all repository contracts passed)

Demo Impact

None.

Docs Impact

None; the existing declaration contract remains unchanged.

API Impact

Internal refactor only. Imperative and quick declaration paths now derive their accepted attributes from the same table, preventing future parity drift.

CI Impact

Adds a parity test covering all shared model, command, option, and positional attributes across both declaration APIs.

Security Notes

No new execution or evaluation paths; the existing no-eval declarative runtime and validation boundaries remain intact.

Notes

Structural fields stay in the table for quick rows but are excluded when copying runtime attributes into imperative calls.

Checklist

• Branch name follows <category>/<issue>-<YYYYMMDD>-<slug>.
• Branch category matches the issue label.
• Pull request is scoped to one issue.
• Pull request body explains changes and validation.
• Impact sections are complete.
• Pull request includes Fixes #393.