fix(go,git,arg_tokenizer): close the last three from the review round

golangci-lint 2.x has one `--output.<format>.path` per format, but RTK only
recognized `output.json.path` and `out-format`, so a user asking for text
output got RTK's JSON sink added alongside it -- two reports on stdout, and the
JSON parse then fails on whichever lands first. Any output destination counts
now. Its value-taking list also grew the flags a real `golangci-lint run
--help` lists (2.13.1) plus the 1.x ones RTK still supports: `--concurrency`,
`-e`/`--exclude`, `-p`/`--presets`, `--skip-dirs`, `--skip-files`,
`--deadline`. Missing them made `run -e '--out-format'` read the exclude
pattern as an output flag and skip RTK's injection entirely.

`git show` prepended its own shape flags, so a user `-p`/`-u`/`--patch`/`-U5`
won last and re-enabled the patch in the summary and stat steps -- the result
stopped being smaller than raw and never_worse discarded it, returning the full
commit after four git subprocesses. They go where git still reads them and
after the user's own now, the same placement run_diff uses: `git show -p` on a
real commit is 25kB instead of 52kB.

`Token::value` indexed `tokens[idx]` unchecked, which only held because every
caller happened to pass the whole vec -- `before_dashdash` now hands out slices
routinely, and a panic inside a filter is the one thing RTK must never do. It
also answered a consumed positional with the *name* of the flag that consumed
it; that direction of `linked` means "my owner", not "my value".

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>