refactor(cli): extract runners and arguments from app.py

Split the 1206-line cli/app.py by moving two independent leaf groups into
sibling modules:

- runners.py: run_case_analysis / run_md_direct_codeql / run_md_source_analysis
- arguments.py: SUBCOMMANDS, _normalize_cli_args, parse_arguments,
  list_providers, _resolve_model_args

app.py stays the entry point and re-export hub. The dispatch/handler chain
and run_project_import remain in app.py on purpose: run_project_import calls
import_project_for_workflow, which tests monkeypatch at
pure_auto_codeql.cli.app.* -- moving it would resolve the name in a sibling
namespace and silently miss the patch.

Function bodies moved verbatim (byte-identical, verified via AST). An
explicit __all__ documents and protects the public re-export surface that
Analyze.py depends on. 89 passed / 2 skipped.

Author: bx33661