fix(cli): validate action combinations before credentials

[bdsqqq]

changes

• reject conflicting generated read/write/deletion actions before credentials
• reject blank batch fields while preserving valid zero/empty payloads elsewhere
• false subscription actions no longer select updates; false data mutations remain meaningful
• route documented two-token issue batch invocations; retain quoted legacy form

verification

• full offline tests, typechecks, generation, artifact integrity checks and build pass
• independent final review found no regressions; 10 credential-stubbed entrypoint probes pass
• no new live API calls; artifact integrity is not completeness

remaining

0104 mutation output contracts and 0105 unknown priority fallback remain open. full parity remains incomplete. stacked on #35 (CI 35935914591 passed); draft only.