fix: handle shell-safe URLs and preserve custom subscription DNS

[MicroMilo]

What problem does this solve?

This PR addresses two independent failure points that can appear in the same subscription onboarding flow.

1. Shell parsing can truncate subscription URLs

Subscription URLs commonly contain &, for example:

https://example.com/sub?target=clash&emoji=true&udp=true

When such a URL is passed to clash add without quotes, Bash treats each & as a background-command separator before clash receives the arguments. Only the prefix reaches clash add, the subscription name is not saved, and a subsequent clash use <name> reports that the subscription does not exist.

The README now shows both safe forms:

clash add 'https://example.com/sub?target=clash&emoji=true' west
clash add
# paste the complete URL when prompted

2. Runtime normalization can overwrite a subscription's DNS listener

Some providers publish a local DNS forwarder such as:

dns:
  listen: 127.0.0.1:7874
  proxy-server-nameserver:
    - udp://127.0.0.1:7874

The current normalization path always replaces dns.listen with CLASH_DNS_PORT. That can leave proxy-server-nameserver pointing at a port that is no longer listening, so the subscription fails after it has been added successfully.

This PR adds the opt-in setting CLASH_PRESERVE_DNS_LISTEN=true to preserve the subscription's complete dns.listen value. A preserved port is never silently reassigned: conflicts produce a clear error instead.

Compatibility

• CLASH_PRESERVE_DNS_LISTEN defaults to false, so existing installations keep their current behavior.
• When enabled, a missing or invalid subscription dns.listen falls back to CLASH_DNS_PORT.
• The shell-quoting issue and the DNS-normalization issue have different root causes; the former is addressed with documentation, while the latter is addressed in the runtime code.

Refs #295

Validation

• bash -n scripts/core/config.sh scripts/core/clashctl.sh scripts/dev/check-runtime-config-normalization.sh
• git diff --check
• bash scripts/dev/check-runtime-config-normalization.sh
• bash scripts/dev/check-clash-command-entry.sh
• bash scripts/dev/check-sub-update-compat.sh
• bash scripts/dev/check-text-encoding.sh