refactor(commands): declare project-config admission and recorder sanitization on the flag declaration #2445

Wave 2 child of #2409. The "#1665-shaped follow-up" named in PR #2421; hops A11 and A18 in the #2410 hop trace.

Purpose

A flag that may be set from agent-device.json, or that the session recorder may copy into SessionAction.flags, is declared once, on its flag declaration. Today each property is a separate hand-maintained allowlist, fail-closed by omission, so adding a flag that needs either behaviour edits the allowlist file as well.

Baseline

On main at 41e2633f10:

• PROJECT_CONFIG_FLAG_KEYS: module-private Set<FlagKey> of 85 keys at src/cli-schema/cli-config.ts:37. One consumer at :219 rejects any project-config key outside the set with INVALID_ARGS.
• SANITIZED_FLAG_KEYS: module-private tuple of 39 keys (33 literals plus SCREENSHOT_ACTION_FLAG_KEYS from packages/contracts/src/screenshot.ts:81) at src/daemon/session-action-recorder.ts:360. One consumer, sanitizeFlags at :397, copies only these keys into the recorded action.
• Flag declarations: 156 across src/commands/cli-grammar/flag-definitions-{action,connection,target,workflow}.ts (39 / 38 / 44 / 35), typed by FlagDefinition at src/commands/cli-grammar/flag-types.ts:19. refactor(commands): declare a command option once and derive its surfaces #2421 added inputDescription there and derived the command input field from it.
• No test pins membership of either set. A flag omitted from either set is silently rejected or dropped.
• The refactor(commands): declare a command option once; derive cli-schema, MCP schema and daemon flags from the descriptor #2410 hop trace classifies both sets as "fail-closed by omission, so they must move onto the option declaration as explicit fields, never be inferred from a flag's existence".
• Replay of feat(ios): expose AX custom actions on merged accessibility elements #1665 (snapshotCustomActions): the change edited both sets in addition to the declaration.

Required work

1. Add two required fields to FlagDefinition: projectConfig: boolean (may be set from agent-device.json) and recorded: boolean (copied into SessionAction.flags). Required, not optional. Omission must be a type error, so the fail-closed property is held by the compiler instead of by a list.
2. Populate the 156 declarations from the current sets exactly (85 true / 71 false; 39 true / 117 false). Mechanical.
3. Derive: cli-config.ts:219 and sanitizeFlags read the sets derived from the declarations. Delete the two literal sets. SCREENSHOT_ACTION_FLAG_KEYS stays while screenshot-options.test.ts still consumes it.
4. Planted divergence test, per the refactor(commands): declare a command option once and derive its surfaces #2421 pattern (src/commands/command-input-option-field.test.ts): flipping recorded or projectConfig on one declaration changes the corresponding admission or sanitization outcome, observed through the production derivation.

Acceptance, measurable from git

• Re-doing feat(ios): expose AX custom actions on merged accessibility elements #1665's flag addition edits the declaration (with both fields) and no allowlist. src/cli-schema/cli-config.ts and src/daemon/session-action-recorder.ts are untouched by the replay.
• The derived sets equal the deleted sets: the PR records the one-off diff (empty) and the existing project-config and recorder tests stay green with no edits.
• A flag declaration without both fields does not compile.

Non-goals

• Inferring either property from a flag's existence, type or command. Rejected in the trace.
• CONFIG_EXCLUDED_FLAG_KEYS (6 keys) and ENV_EXCLUDED_FLAG_KEYS (2 keys) at src/cli-schema/option-schema.ts:21 and :30. These are fail-open exclusions with a different safety property. Fold them in only if the same PR shows the same fail-closed guarantee for them; otherwise leave them.
• Per-command allowedFlags (36 sites): per-command admission, not collapsible (trace A3).

Dependencies

None. Builds on #2421 (ad79461c72).