feat: attach lifecycle to existing Click trees

[codeforester]

Summary

• add identity-preserving App.attach() and base_cli.attach() APIs for existing nested, aliased, chained, prebuilt, and lazy Click command trees
• keep one lifecycle active through selected callbacks, result callbacks, Click resources, history, metadata, and Base cleanup without eagerly importing unselected commands
• preserve Click callback results and Context.obj, expose factory-created application context/services, and reject nested duplicate lifecycles
• reuse compatible root lifecycle options, add public attachment sensitivity policy, and scope argv/redaction state across direct and nested Click invocations
• document the integration contract and add adversarial transactional, teardown-order, compatibility, and secret-leak coverage

Issue

Closes #57

Validation

• PYTHONPATH=lib/python python -W error -m pytest -q — 282 tests + 54 subtests passed on Click 8.4.2
• PYTHONPATH=<click-8.1.8>:lib/python python -W error -m pytest -q — 282 tests + 54 subtests passed
• ./tests/validate.sh
• python -m compileall -q lib/python tests
• git diff --check
• isolated wheel and sdist build
• python scripts/validate_package_artifact.py <dist>
• python -m twine check <wheel> <sdist>

Notes

#58 remains the intentional follow-up for independently composable lifecycle options, including public-name default_map and runtime auto_envvar_prefix bridging.

Checklist

• Branch name follows <category>/<issue>-<YYYYMMDD>-<slug>, and its category prefix matches the issue's single standard category label.
• Pull request is scoped to one issue, unless a documented multi-issue exception applies.
• Pull request body explains what changed and how it was validated.
• Relevant project checks pass.
• Documentation is updated when behavior or user-facing commands change.
• CHANGELOG is updated for notable user-visible or release-worthy changes.
• Pull request includes Fixes #<issue> or Closes #<issue> when merge should close the issue.