fix: add defensive guard on child.aliases in collectChildNames

Stricli always provides aliases at runtime (empty array when none),
but type it as optional and use ?? [] for defensive safety per
Seer and BugBot review feedback.

Author: BYK

src/lib/list-command.ts

@@ -341,10 +341,14 @@ let _subcommandsByRoute: Map<string, Set<string>> | undefined;
  * Lazily walks the Stricli route map on first call. Uses `require()` to break
  * the circular dependency: list-command → app → commands → list-command.
  */
-/** Entry shape returned by Stricli's getAllEntries() */
+/**
+ * Entry shape returned by Stricli's getAllEntries().
+ * `aliases` is always present at runtime (empty array when none),
+ * but typed as optional for defensive safety.
+ */
 type RouteEntry = {
   name: { original: string };
-  aliases: readonly string[];
+  aliases?: readonly string[];
   target: unknown;
 };
 
@@ -355,7 +359,7 @@ function collectChildNames(parent: {
   const names = new Set<string>();
   for (const child of parent.getAllEntries()) {
     names.add(child.name.original);
-    for (const alias of child.aliases) {
+    for (const alias of child.aliases ?? []) {
       names.add(alias);
     }
   }