buildListCommand injected flags

buildListCommand() must always inject --fresh and --cursor unless already defined; freshness uses FRESH_FLAG and applyFreshFlag(). Its first positional passes through interceptSubcommand() to recover plural-alias confusion. Trap: treating the resulting args: string[] as containing only strings looks type-safe, but interception may replace args[0] with undefined. Fix: filter null, undefined, and empty strings before string operations or positional parsing.