feat(runtime): add declarative JSON body flags

[samzong]

What's changed?

• add an opt-in body.flags overlay that projects flat JSON request bodies into typed CLI flags
• preserve descriptions, formats, enums, and map schemas across OpenAPI, Swagger, and protobuf backends while rejecting unsupported body shapes
• validate required body fields, enum items, flag bindings, and mixed body inputs without panics
• redact schema-declared password fields in dry-run output
• bump the generated runtime schema to 13 and the catalog schema to 20

Why

• make JSON request bodies discoverable and usable through normal CLI flags without replacing --file, --set, or --set-str
• keep generated code, runtime behavior, catalog metadata, and backend schema fidelity aligned under an explicit versioned contract

Verification

• make check
• go test -race -count=1 ./...
• generated and built a Tokener scratch CLI, then passed __lathe verify --json
• exercised typed flags, --set-str, stdin --file -, enum rejection, mixed-input rejection, catalog schema 20, and dry-run password redaction

[codspeed]

Merging this PR will not alter performance

⚠️ Unknown Walltime execution environment detected

Using the Walltime instrument on standard Hosted Runners will lead to inconsistent data.

For the most accurate results, we recommend using CodSpeed Macro Runners: bare-metal machines fine-tuned for performance measurement consistency.

✅ 21 untouched benchmarks

---

_{Comparing feat/json-body-flags (8ef30b0) with main (9d4892b)}