fix(cli): block config prototype pollution

[lazyGPT07]

Summary

• reject __proto__, prototype, and constructor in config paths and merged config files
• traverse only own config properties
• avoid inherited-object traversal while creating nested config values
• add regression coverage that verifies Object.prototype remains unchanged

Validation

• CLI suite: 7 tests passed
• CLI TypeScript check passed
• git diff --check passed

Closes #53