fix(portal-clis): reject undefined single-dash flags in the unknown-flag guard (#428)

The guard in the four bunli-based CLIs inspected only tokens starting
with `--`, so an undefined short flag bypassed it: bunli discarded it,
the search ran unfiltered, and the CLI exited 0. Live against jobnet,
`search -q "sygeplejerske"` returned all 18,179 ads as a successful
search against 667 for the real `--search-string` query - the same shape
as review finding F13 that motivated the guard.

Both dash forms are now checked. Declared shorts (jobindex's -q) and
bunli's built-in -h/-v stay valid. A negative number is rejected too:
bunli discards a `-`-prefixed token rather than consuming it as the
previous flag's value, so `--radius -5` silently fell back to the
default instead of failing its own min(1) schema; a value that must
begin with a dash uses the `--flag=value` form.

Fixes #426.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

.agents/skills/jobindex-search/cli/tests/cli-flag-validation.test.ts

@@ -77,4 +77,40 @@ describe("unknown flag rejection", () => {
     expect(error.code).toBe("UNKNOWN_FLAG");
     expect(error.error).toContain("--bogus-flag");
   });
+
+  // #426: the guard inspected only `--long` tokens, so a single-dash flag was
+  // discarded in silence. This CLI is the one portal that declares a short
+  // (`-q` for --query), so the fix has to reject undeclared shorts without
+  // breaking the declared one.
+  test("an undeclared short flag exits 1 with a JSON error", async () => {
+    const result = await runCLI(["search", "-z", "bogus"]);
+    expect(result.exitCode).toBe(1);
+    expect(result.stdout).toBe("");
+    const error = JSON.parse(result.stderr);
+    expect(error.code).toBe("UNKNOWN_FLAG");
+    expect(error.error).toContain("-z");
+  });
+
+  // Network-free proof that the declared short survives the guard: -q is
+  // scanned before --bogus-flag, so naming --bogus-flag in the error means -q
+  // passed. Asserting -q is accepted directly would require a live search.
+  test("the declared short -q passes the guard", async () => {
+    const result = await runCLI(["search", "-q", "test", "--bogus-flag", "xyz"]);
+    expect(result.exitCode).toBe(1);
+    const error = JSON.parse(result.stderr);
+    expect(error.error).toContain("--bogus-flag");
+    expect(error.error).not.toContain("-q ");
+  });
+
+  test("a negative number is rejected instead of silently falling back to the default", async () => {
+    const result = await runCLI(["search", "--query", "test", "--limit", "-5"]);
+    expect(result.exitCode).toBe(1);
+    expect(JSON.parse(result.stderr).code).toBe("UNKNOWN_FLAG");
+  });
+
+  test("-h still prints help rather than being rejected as unknown", async () => {
+    const result = await runCLI(["search", "-h"]);
+    expect(result.exitCode).toBe(0);
+    expect(result.stderr).toBe("");
+  });
 });