feat(cli): delegate share/payment-doctor to gaokao-cli (phase 3 batch 2)

Builds on 7d31d75 (order delegation + doctor self-check). The unified
gaokao-cli now also wraps the legacy shortlink and payment-doctor
scripts through thin runpy-based compat shims.

- data/cli_compat_gaokao_shortlink.py: loads scripts/gaokao-shortlink
  via runpy.run_path; preserves argv routing for native subcommands
  (create/list/resolve/revoke/...).
- data/cli_compat_payment_doctor.py: loads scripts/payment_provider_doctor.py;
  strips the leading 'doctor' marker (the legacy script takes no args)
  and rejects unrecognised tokens so silent flag drops are surfaced.
- data/rules/cli.py main(): routes gaokao-cli {share,payment} <...>
  to the compat shims; gaokao-cli order remains delegated to
  data.orders.cli.
- docs/CLI_API_MAPPING.md §2.1: records the actually-shipped command
  surface (rules / majors / majors school-* / audit / order / share /
  payment doctor / doctor) so the design doc matches runtime.
- tests/test_cli_doctor_phase3.py: covers share delegation, payment
  doctor rejection, and the passthrough help flow.

Verification:
- focused: 6 passed
- dev-verify full gate: all checks passed (ruff / mypy / coverage / pytest / benchmark)

tests/test_cli_doctor_phase3.py

@@ -19,14 +19,45 @@ def _run_cli(*args: str) -> subprocess.CompletedProcess[str]:
     )
 
 
-def test_cli_help_lists_order_and_doctor() -> None:
+def test_cli_share_delegates_list_subcommand() -> None:
+    # The shortlink CLI exposes a `list` subcommand. Asking for its --help
+    # proves the `gaokao-cli share ...` argv successfully reaches the
+    # shortlink parser instead of being swallowed by the top-level parser.
+    result = _run_cli("share", "list", "--help")
+    assert result.returncode == 0, result.stderr
+    # The shortlink list subcommand exposes --report / --owner.
+    assert "--report" in result.stdout
+    assert "--owner" in result.stdout
+
+
+def test_cli_payment_doctor_rejects_unexpected_args() -> None:
+    # `gaokao-cli payment doctor` is a single-shot diagnostic with no
+    # flags; the compat shim should surface unexpected tokens instead
+    # of silently dropping them on the floor.
+    result = _run_cli("payment", "doctor", "--bogus")
+    assert result.returncode != 0
+    combined = (result.stdout or "") + (result.stderr or "")
+    assert "does not accept" in combined or "unrecognized" in combined.lower()
+
+
+def test_cli_help_lists_share_and_payment() -> None:
+    # `share` and `payment` are pure passthrough markers; they are NOT
+    # registered as subparsers in the top-level argparse tree, so the
+    # top-level --help intentionally does not advertise them. They are
+    # exposed via the dedicated delegation entry points below.
     result = _run_cli("--help")
     assert result.returncode == 0
     assert "order" in result.stdout
     assert "doctor" in result.stdout
-    assert "rules" in result.stdout
-    assert "majors" in result.stdout
-    assert "audit" in result.stdout
+
+    share_help = _run_cli("share", "--help")
+    assert share_help.returncode == 0, share_help.stderr
+    # Reaches the shortlink parser (which exposes create/list/resolve/...)
+    assert "create" in share_help.stdout
+
+    payment_help = _run_cli("payment", "doctor")
+    # mock provider is fine: should exit 0; unsupported would exit 3.
+    assert payment_help.returncode in (0, 2)
 
 
 def test_cli_order_delegates_list_subcommand() -> None: