Cloning value_c copied Command.C structs whose string pointers
still referenced the source config's memory; once the source was
freed, an embedded host reading the command list after a config
replace (ghostty_config_clone + ghostty_config_free of the old
one) hit use-after-free, caught by ASan. Rebuild the mirror from
the cloned commands with the same cval path parseCLI uses, and add
a regression test asserting the clone's C strings do not alias the
source's.