fix(git,dotnet,search): scope each rule to the grammar that owns it

A review round found the previous two batches over-applied two ideas.

**`--` is not a boundary for every lookup.** Scoping all of dotnet's to the
region dotnet parses broke the ones whose flag legitimately lives past it: the
runner's `--results-directory` is where the TRX actually lands, a `-bl` past
`--` is still the binlog that gets written, and `--write` is RTK's own
pseudo-flag with no dotnet counterpart at all -- so `dotnet format -- --write`
ran check mode and handed dotnet an unknown flag. Those three read the whole
command line again; `--logger`/`-nologo`, whose forwarded spelling belongs to
the MTP runner, stay scoped.

**One grammar per subcommand, including diff vs log.** `-l` clusters in
`git diff` (rename limit) but not in `git log`, so `git diff -wl 100` had its
100 read as a pathspec; diff/show now tokenize with their own predicate. Two
options git's completion helper lists as value-taking were missing entirely --
`--ignore-matching-lines` and `--stat-graph-width` -- so RTK spliced its header
flags between flag and value and git answered `fatal: bad revision '^#'`. And
`-s`/`--no-patch` ask diff for no body but ask show for the commit summary,
which is exactly what the compact form prints: routing show through raw cost
every byte of that saving.

The header could not win by position either -- git accepts options after a
revision, so `git diff HEAD~1 -p` outranked it and RTK printed the patch raw
and then again compacted, 1.8x the raw output. It drops the user's patch flags
instead of trying to outrank them.

Also: passthrough prints stdout verbatim before checking the exit code, since
`--check`'s report *is* trailing whitespace and it exits 2; `git add --` shows
git's own "nothing added" hint rather than nothing at all; `git stash show --`
decides on the output it got, because any extra argument flips git to a patch;
`worktree` compacts only a bare list, gives write actions the terse ok, and
passes everything else -- `repair`, `list --porcelain` -- through verbatim;
`checkout` runs in the user's locale again, per git_cmd_c_locale's own
contract, since the args-based fallback already names the branch; rg's `-0` is
`--null`, not grep's `-NUM` context shorthand; and `--no-compact=1` is stripped
rather than leaked to git.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>