feat(config): generate the config settings help from KeySchema

Depends on !3799 (merged) — targets that branch, and the diff shown here is only this commit once !3799 (merged) merges.

What

The Current respected settings list in glab config was a hand-written heredoc with no connection to KeySchema. That disconnect is how #8516 (closed) shipped: glab_pager and visual were documented but unsettable, while a third of the settable keys were never documented at all.

This renders the list from KeySchema.

• Adds KeyDef.HelpHidden for keys the CLI maintains for itself (last_seen_version, last_whatsnew_version, last_update_check_timestamp, the duo_cli_* / orbit_local_* binary paths, user). They stay settable, they just leave the help.
• Documented keys go from 21 to 34. Per-host keys — api_host, api_protocol, proxy, skip_tls_verify, ca_cert, client_cert, client_key, subfolder, ssh_host, job_token, use_keyring, the registry domain lists, custom_headers — were never listed, and are now marked Scoped per host; set it with --host.
• Aliases are named on their canonical key's row (- `editor`: … Also accepted as: `visual`, `glab_editor` ) instead of appearing as a bare entry (visual) or not at all (gitlab_token, prompt_disabled, gl_host).

Scope: config keys only, not environment variables

#8375 asks for both surfaces. I've deliberately done only the config-key half, because the premise does not hold for the env-var table.

KeySchema is not the source of truth for environment variables. Eight of the variables documented in root.go are read directly through os.Getenv / IsEnvVarEnabled, never through the config layer:

Variable	Read at
GLAB_CHECK_UPDATE	internal/commands/update/check_update.go, cmd/glab/main.go
GLAB_GLAMOUR_STYLE	internal/iostreams/iostreams.go
GLAB_NO_PROMPT	cmd/glab/main.go
GLAB_FORCE_HYPERLINKS	cmd/glab/main.go
GLAB_DEBUG_HTTP	internal/api/client.go
GLAB_CONFIG_DIR, GLAB_ENABLE_CI_AUTOLOGIN, NO_COLOR	process-level, not config-backed

Generating that table from KeySchema alone would delete all eight from the docs while they keep working — the same failure mode as the closed !3660 (closed), which generated the config list from KeySchema and silently dropped glab_pager and visual.

Reconciling that surface means either registering the process-level variables in KeySchema with a marker, or adding a second declarative table for them. Both are real design decisions and neither belongs in this MR. #8375 should stay open for it.

Notes for review

• gen-docs output is idempotent and markdownlint-clean. Getting there needed two fixes at the source rather than in the generated file, because markdownlint-fix and check-docs otherwise overwrite each other on every commit: descriptions now use 'single quotes' consistently for literals (the renderer converts them to backticks, which also satisfies MD044), and a few prose fixes (git → Git, CAs → certificate authorities).
• describe appends a period when a description lacks one, so every bullet terminates consistently. There's a test asserting that.
• Test coverage: every documented key appears exactly once, hidden and non-settable keys are absent, every alias of a documented key is present, and every rendered line is a single bullet.

Part of #8375