[scanner] unknown/misspelled --flags are silently ignored (--captur=50, --entr, --from-begining) while unknown commands and --filter types exit 2 #346

Bug

pluk exits 2 for an unknown subcommand (src/cli.ts:494) and for an unknown --filter event type (src/cli.ts:117), but an unknown or misspelled --flag is accepted silently and ignored. parseArgs (src/cli.ts:72-96) only consults VALUE_FLAGS / BOOL_FLAGS to decide whether a value is required or forbidden; any other --name is stored in flags and nothing downstream ever checks that it was consumed.

// src/cli.ts parseArgs
if (eqIdx > 0) {
  const name = arg.slice(2, eqIdx);
  ...
  flags[name] = value;        // no membership check
} else {
  const name = arg.slice(2);
  if (VALUE_FLAGS.has(name)) { ... exit 2 }
  flags[name] = 'true';       // no membership check
}

So a typo in exactly the flags #342 and #339 just hardened changes behaviour without any signal:

Each of these is the same silent-fallback shape that #342 fixed for --diagnostics=abc, one level up: the flag's name is unchecked instead of its value.

Reproduce

printf 'hello\n' | pluk watch x --captur=50 ; echo "exit=$?"   # streams stdin, exit=0, no warning
pluk send x --text=hi --entr ; echo "exit=$?"                   # no error about --entr
pluk watch x --filter=bogus ; echo "exit=$?"                    # exit=2 "unknown event type" — the inconsistent sibling

Expected

Unknown --flags exit 2 with Error: unknown flag --captur (see pluk --help), matching the existing unknown-command / unknown-event-type behaviour. The per-command flag set is already spelled out in usage() (src/cli.ts:22-28), so a KNOWN_FLAGS set (or a per-command allow-list) can be derived without inventing new surface: help, h, text, session, run-dir, cli, command, cli-args, rebuttal, dir, rationguard-bin, patterns-dir, pane, filter, from-beginning, verbose, include-raw, rationguard, no-raw, no-open, dangerous, json, enter, literal, capture, diagnostics.

Tests

test/cli-error-paths.test.js:331-347 covers missing values for known flags and test/cli-bool-flags.test.js covers =true/=false; no test asserts an unknown flag is rejected. Add one case per shape (--captur=50, bare --entr) to test/cli-error-paths.test.js.

Decision taken by hive: reject globally in parseArgs with a single KNOWN_FLAGS set (simplest, additive, mirrors the existing VALUE_FLAGS/BOOL_FLAGS sets) rather than per-command allow-lists; per-command scoping can follow if wanted.

Evidence at 84d5079 (main after #343).

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88