fix(portals)!: reject unknown flags in all six CLIs

Silently discarded flags produced silently wrong results: jobdanmark
with --query (its real flag is --text) returned all 13,862 jobs as if
they matched, exit 0, empty stderr - indistinguishable from a real
result set. The four bunli CLIs get an argv preflight built from each
command's own options object; linkedin and freehire validate parsed
flags against per-command known sets. help/version still pass, and
add-portal.md's existing bogus-flag-exits-1 contract now holds for the
reference implementations contributors copy. One linkedin pin updated:
"--jobage-minutes -5" now fails as UNKNOWN_FLAG (the stray -5 token)
rather than BAD_ARG - same loud-failure invariant, earlier gate. Review
finding F13 (2026-08-19), decision approved by Mads.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -65,6 +65,14 @@ per-file diff commands.
 
 ### Changed
 
+- **BREAKING (scripts passing stray flags): all six portal CLIs reject unknown flags**
+  with exit 1 and `{"error", "code": "UNKNOWN_FLAG"}` on stderr, instead of silently
+  discarding them. A discarded filter changes what a search returns with no error - a
+  wrong flag name on jobdanmark returned the entire database (13,862 results, none
+  matching) as if it matched the query, and the six portals use four different names for
+  the free-text flag, so cross-portal guessing is likely. `add-portal.md` already
+  required contributed portals to exit 1 on a bogus flag; the reference CLIs now meet
+  their own bar. Pinned by nine new cases across the six `cli-flag-validation` suites.
 - **`/rank` persists its location verdict as `location_verdict`** - the bare `location`
   key meant two incompatible things in `seen_jobs.json`: a place (scraper search output,
   driving the commute filter) and a PASS/FAIL/FLAG verdict (`/rank` Step 4), so ranking