Refactor CLI parser to strict fail-closed architecture

[MagersCode]

Summary

Refactored the CLI parser from a fail-open structure to a strict, fail-closed architecture. This prevents unrecognized subcommand trailing arguments or keywords (like passing raw keywords into the prompt path) from silently dropping through to the LLM prompt fallback, protecting against accidental network calls and unwanted token usage. Additionally, implemented short-circuiting logic for --help requests to resolve instantly and prevent live runtime hanging bugs.

Anti-slop triage

• Classification: actionable-fix
• Evidence: Unit tests parses_bare_prompt_and_json_output_flag and resolves_model_aliases_in_args originally failed under the strict parsing behavior because they expected leaky drop-through prompts, until they were updated to assert for the new secure boundary guidance error. Local verification command ran successfully: cargo test -p rusty-claude-cli --bins
• Non-destructive review result: merge candidate

Verification

• Targeted tests/docs checks ran, or the gap is explicitly recorded.
• git diff --check passes.
• No live secrets, tokens, private logs, or unrelated generated churn are included.

Resolution gate

• If this PR resolves an issue, the issue number and fix evidence are linked. (Independent catch/contribution)
• If this PR should not merge, the rejection/defer rationale is evidence-backed and does not rely on vibes.
• I did not merge/close remote PRs or issues from an automation lane without owner approval.