feat(lathe): add generated command shortcuts

[samzong]

Summary

• Add overlay-defined root-level shortcuts for generated API commands, including preset params and validation for shortcut conflicts.
• Surface shortcuts through generated specs, the runtime catalog, search, and generated Skill guidance.
• Add a hidden root login compatibility command that maps to auth login, plus a petstore pet-123 shortcut example.

Verification

make check
go build ./...
go test -race ./...
git diff HEAD~1..HEAD --name-only -- '*_test.go'

Temporary petstore E2E was also run with:

go build -o "$lathe_bin" ./cmd/lathe
cp -R examples/petstore/. "$workdir"
go mod edit -replace github.com/lathe-cli/lathe="$repo"
"$lathe_bin" codegen -cache fixtures -overlay overlays -skill-root ""
rg -q "Shortcuts: \\[\\]runtime.CommandShortcut" internal/generated
rg -q "pet-123" internal/generated
go mod tidy
go build -o bin/petstore ./cmd/petstore
./bin/petstore --help
./bin/petstore login --help
./bin/petstore commands show pet-123 --json
./bin/petstore search pet-123 --json

Compatibility

• Runtime CommandSpec schema is bumped to 7 for shortcuts.
• Runtime catalog schema is bumped to 6 for shortcuts.
• Generated shortcut commands are root-level commands that execute the same operation with preset values; invocation flags can still override those presets.
• login is a hidden root compatibility command and is not shown in root help.
• No generated output under internal/generated/, .cache/, or ad-hoc skills/<cli-name>/ directories is committed.

Checklist

• Tests or focused verification cover the changed surface.
• User-facing behavior changes are documented.
• Generated output under internal/generated/, .cache, and ad-hoc skills/<cli-name>/ directories is not committed.
• Commits are signed off when this is ready to merge.