feat(e13-s2/s3): add --from-env and --from-file local input sources

[imneov]

What

E13-S2 + E13-S3: two zero-network input sources for claudecm add, both reusing the existing add pipeline (name validation, --dry-run, redaction, overwrite guard, SaveProfile; no auto-activation).

• add <name> --from-env — reads the Claude Code / Codex env-var allowlist via internal/envextract (no scattered os.Getenv). Explicit flags win over env.
• add <name> --from-file <path> — new internal/fileparse auto-detects dotenv / shell export / JSON / YAML / TOML and maps to core fields. Explicit flags win over file values.

Review trail

Fresh-context adversarial review → REQUEST_CHANGES (3 findings), all remediated in bebdc56:

• High — conflicting aliases for the same field (e.g. api_key vs core.api_key) were resolved by nondeterministic map order → now refused with a redacted-value diff; identical values pass.
• High — unclosed quotes in dotenv/shell were written as literal corrupted values → now refused (unclosed double quote).
• Medium — --from-file/--from-env refused "no key" at parse time before --api-key could supply it → keyless check moved to the final merged draft, so explicit flags override as S3 requires.

Independently verified end-to-end with the built binary (exit codes shown):

• conflicting api_key → refuse (exit 1), message sk-g***7890 conflicts with sk-b***7890
• unclosed quote → refuse (exit 1)
• no-key file, no flag → refuse (exit 1); no-key file + --api-key → dry-run OK (exit 0)
• --from-env no key → refuse (exit 1); + --api-key → OK (exit 0)

go test ./... and go vet ./... clean. Zero network. No --from-text/--ai scope in this PR.

🤖 Generated with Claude Code