fix(runtime): validate body-backed required inputs

[samzong]

Summary

• Allow body-backed required GraphQL variables to be satisfied after --file, --set, or --set-str body input is merged.
• Parse --set field=[] as an explicit empty JSON array while preserving string behavior through --set-str.
• Closes bug(runtime): validate required fields after merging file and set bodies #68.
• Closes bug(runtime): support explicit empty array body inputs #70.

Verification

• make check
• go test -count=1 ./pkg/runtime -run "TestBuild_RequiredVariableCanComeFromBodyInput|TestBuildBodyFromSet_ArrayIndex|TestBuildEnvelopeBody|TestBuild_VariableFlagsMergeIntoEnvelope"

Compatibility

• Generated CLI body behavior changes only: body-backed required variables can be provided through merged body input, and missing required body fields are still rejected before sending the request.
• Catalog schema and generated output are unchanged.

Checklist

• Tests or focused verification cover the changed surface.
• User-facing behavior changes are covered by existing body flag help; no docs update needed for this bug fix.
• Generated output under internal/generated/, .cache/, and ad-hoc skills/<cli-name>/ directories is not committed.
• Commits are signed off when this is ready to merge.