fix: unify production and test invocation

[codeforester]

Summary

• Route base_cli.testing.invoke() through the same run_app() outcome and rendering boundary used by production entry points while preserving CliRunner capture, home/env isolation, cwd restoration, and separated streams.
• Use a minimal runner adapter instead of a nested Click command so reraise_unexpected=True preserves the original exception and supported Click 8.1 correctly captures safe stderr.
• Remove the framework pre-parser rejection so Click-native --option=value works for application, standard, grouped, and sensitive options.
• Add production-versus-testing parity coverage for parser/callback usage errors, success, unexpected failures, command groups, terminal metadata, effective argv, and sensitive-value redaction.

Issue

Closes #53

Part of #50.

Validation

• Current Click: 169 passed, 23 subtests passed
• Declared minimum Click 8.1.8: 169 passed, 23 subtests passed
• Focused adapter checks also exercised Click 8.4.2
• /Users/rameshhp/work/base-cli/.venv/bin/python -m compileall -q lib/python tests
• ./tests/validate.sh
• /Users/rameshhp/work/base-cli/.venv/bin/python -m build --sdist --wheel --outdir <temporary-directory>
• /Users/rameshhp/work/base-cli/.venv/bin/python scripts/validate_package_artifact.py <temporary-directory>
• git diff --check

Notes

• testing.invoke() remains backward compatible for its existing positional parameters. The new reraise_unexpected switch is keyword-only and defaults to production-safe rendering.
• A handled nonzero test invocation has standard CliRunner semantics: result.exit_code carries the status and result.exception may contain SystemExit. Opting into re-raise exposes the original unexpected exception instead.
• The adapter copies argv and translates the final run_app() status exactly once; it does not add a second Click parsing or exception-normalization boundary.

Checklist

• Branch name follows <category>/<issue>-<YYYYMMDD>-<slug>, and its category prefix matches the issue's single standard category label.
• Pull request is scoped to one issue, unless a documented multi-issue exception applies.
• Pull request body explains what changed and how it was validated.
• Relevant project checks pass.
• Documentation is updated when behavior or user-facing commands change.
• CHANGELOG is updated for notable user-visible or release-worthy changes.
• Pull request includes Fixes #<issue> or Closes #<issue> when merge should close the issue.