[Feat] Support required parameter overrides

[samzong]

Summary

• Add params.<name>.required: true to overlay parsing.
• Merge required parameter overrides into existing generated CommandSpec params.
• Document the tighten-only overlay behavior and cover catalog, runtime validation, and Skill references with tests.

Closes #36

Verification

• make check
• Temporary downstream check in daocloud-skills with local lathe binary:
  • make specsync LATHE=/tmp/lathe-local.5p3xBl
  • make codegen LATHE=/tmp/lathe-local.5p3xBl
  • make build
  • go test ./...

Compatibility

Existing overlays are unchanged unless they opt into required: true. Required overrides only tighten existing generated params; they do not create new flags or relax required params. Catalog schema is unchanged because required was already present on flags. No generated output under internal/generated/, .cache/, or ad-hoc skills/<cli-name>/ directories is committed.

Checklist

• Tests or focused verification cover the changed surface.
• User-facing behavior changes are documented.
• Generated output under internal/generated/, .cache/, and ad-hoc skills/<cli-name>/ directories is not committed.
• Commits are signed off when this is ready to merge.