Fix cmd and entrypoint handling in parser

This utilizes a test provided by @cnf which exposed an issue with the parser injecting `""` for empty json values, which was then interpreted as a value itself by the evaluator. Removing this exposed a ton of fiddly order-dependent bits around entrypoint and cmd, which then needed to be fixed as well.

Hopefully we can address this with versioning and clarifying semantics.
Shouldn't this check happen earlier?