fix(cli): reject program arguments in verdict mode

[oxura]

Fixes #1503.

The existing runtime-argument guard omitted verdict. Thus bend good.bend --verdict bad.bend reported ALL PROOFS CHECK and exited 0: only good.bend was verified and the second pathname was silently ignored. This is not a claim that the kernel certified the bad proof; the invocation is invalid for this single-file mode.

Include verdict in the existing guard. Keep ordinary run arguments, the -- separator, help actions, unknown-option handling, and all verifier/mismatch diagnostics unchanged. Multi-file verification is not added.

Permanent regression: after a kernel corpus worker has obtained an actually accepted proof, invoke that same file with an extra program argument and require exit 1. This reuses the worker's real proof/kernel context, so a missing kernel cannot make an unexercised argument check appear to pass. One check per accepted shard, not one per definition or corpus file. The parent propagates nonzero worker exits so an assertion failure is not classified as an ordinary proof rejection.

Verification:

• bun gates/repo.ts: 54 / 54.
• Built and exercised a compiled, installed-layout CLI with an adjacent bend2 directory.
• Real BendTT kernel controls: {1n == 1n : Nat} accepted; {1n == 2n : Nat} rejected; a trailing bad-proof pathname rejected after this fix.
• Ran the actual updated gates/safe_node.ts with both proof files: it fails against unchanged upstream because the extra argument is accepted, and passes against the fixed CLI while retaining the false-proof rejection.
• 32 source/installed CLI executions covering extra path/value/empty arguments, arguments after --, literal option-like arguments, a separator with no following argument, valid/invalid proofs, ordinary IO.args (including Unicode, an empty string and escaped --verdict), and existing check-only/mutually-exclusive-mode behavior.

The distributed mini-cluster gates/safe.ts corpus was not run here; its actual worker and new assertion were run locally with the real Linux BendTT kernel. Protected bend2/bend.ts, GUIDE.md, CHANGELOG.md, kernel semantics and cap policy were not changed.

[Lorenzobattistela]

Thanks @oxura! We solved #1503 in #1516 instead: extra words after the file now only go to a plain run, and every option refuses them, with a small test in gates/ping.ts.