refactor(cli): delegate paceENSDF config building to library

Remove the duplicated inline paceENSDF config builder in the CLI.
It renormalized branch intensities before filtering, diverging from
the library decay_info_to_config path that library callers use
(audit finding D5). CLI paceENSDF configs now come from
create_config_from_source exactly once per run.

Regression test spies on create_config_from_source during a CLI run.

tests/integration/test_cli_flows.py

@@ -162,3 +162,30 @@ class TestCLIPaceENSDF:
             main(["Tc99", "--output", out, "--neutrino-mass", "0.35"])
         assert exc.value.code == 1
         assert not (tmp_path / "tc99deg.csv").exists()
+
+    def test_cli_builds_paceensdf_config_via_library(
+        self, monkeypatch: Any, capsys: Any
+    ) -> None:
+        """CLI must delegate paceENSDF config building to the library
+        (create_config_from_source), not duplicate it inline (D5)."""
+        import beta_spectrum.nuclear_data as nuclear_data
+
+        real_builder = nuclear_data.create_config_from_source
+        calls: List[Dict[str, Any]] = []
+
+        def spy(source: str, **kwargs: Any) -> Any:
+            calls.append({"source": source, **kwargs})
+            return real_builder(source, **kwargs)
+
+        monkeypatch.setattr(nuclear_data, "create_config_from_source", spy)
+
+        main(["Cs137", "--dry-run", "--intensity-cutoff", "0.9"])
+        capsys.readouterr()
+
+        assert len(calls) == 1, (
+            "CLI must delegate paceENSDF config building to the library "
+            "builder exactly once"
+        )
+        assert calls[0]["source"] == "paceENSDF"
+        assert calls[0]["nuclide"] == "Cs137"
+        assert calls[0]["intensity_cutoff"] == 0.9