fix: enforce strict CLI argument validation

[rogerchappel]

Summary

• reject unknown options and options missing required values with exit code 1 and stderr diagnostics
• require exactly two compare inputs and require every explicit check glob to match before reading prompts or emitting a report
• document strict parsing and exit-code behavior

Commits

• test: cover strict CLI argument validation — reproduces unknown option, missing value, extra compare input, and mixed matched/unmatched check input behavior; also protects documented option forms
• fix: enforce strict CLI arguments — validates command-specific options, required values, compare arity, and each check glob
• docs: document strict CLI error behavior — describes all strict input and exit-code guarantees

Verification

• npm ci
• npm run release:check
• git diff --check

npm run release:check passed typechecking, all 17 tests, build, smoke, and package smoke.