fix: reject unknown options instead of misparsing as args

Remove allowUnknownOption(true) and allowExcessArguments(true) which caused
unknown flags like --json to be treated as positional arguments, leading to:
- Misparsed pattern/path arguments
- Junk directory creation via ensureProjectPaths()
- Silent search failures returning 0 results

Also remove the now-unnecessary exec_path?.startsWith("--") workaround.

Add tests confirming unknown options and excess args are rejected.