chore: prepare cl-cli for its public 0.1.0 release

[takeokunn]

Summary

Consolidates the accumulated parser/model hardening and the publication-readiness work into a release-ready state for the first public 0.1.0 release. Verified with 190 passing tests on both SBCL and ECL, and every README code example executed against the built system.

Functional / library

• :requires-any-of on make-option — "at least one of" alternatives, with the new cli-missing-any-of-options condition, help rendering, and make-app rejection of unsatisfiable specs.
• Completion renderers return a string when called with no stream (mirroring format's destination contract). Previously the no-stream form wrote to *standard-output* and returned no values, so the documented (write-string (render-completion ...)) pattern was impossible. Passing a stream still writes and returns no values.
• Parser/model fixes: attached-value command completion, short-cluster :stop-parsing-p remainder, separated bare - optional values, required-after-optional positional rejection, colliding option-key rejection, reserved :help/:version key rejection, post-separator runtime-marker handling, validate-before-intern for option/positional keys, and a per-app relation-rulebase cache that no longer corrupts reused command specs.
• Performance: reuse the option-relation Prolog rulebase built at make-app time instead of rebuilding it on every parse-argv call.

Publication / non-functional

• Fix broken absolute-path (/Users/...) links in README.md / SUPPORT.md.
• Give SECURITY.md a concrete private reporting path (GitHub advisories), satisfying the RELEASING.md gate.
• Document the cl-prolog git-dependency install path; a bare ql:quickload cannot resolve cl-cli on its own.
• Restructure CHANGELOG.md into Keep a Changelog format.
• Add a Public API reference section to README.md covering previously undocumented entry points.

Test plan

• nix flake check (CI) — runs the suite under SBCL and ECL.
• Local: 190 passed, 0 failed under both SBCL and ECL.
• All 16 documented README snippets executed against the loaded system.