fix(cli): reject unexpected operands before command side effects

[cppla]

Summary

• Share plain flag parsing with an operand guard across option-based commands.
• Reject accidental operands in token/cert before any credential output and in benchmark commands before startup; retain the existing guard for init/config-backed commands.
• Preserve standard flag/help behavior, CLI/config precedence and current --config scope; do not echo operand values in the new diagnostic.
• Document the current-source behavior and add file-absence and pre-startup regressions.

Validation

• Negative original-code baseline reproduced six token/cert cases that created output despite invalid operands and four benchmark cases that reached later semantic validation. Init controls already passed. Tests use owned temporary output; benchmark baseline inputs prevent network activity.
• Go 1.27.1 focused race tests, fixed shuffle, 10 repeats: passed.
• Go 1.25.13 focused race tests, 3 repeats: passed.
• Linux arm64 Docker Go 1.25.13 focused race tests, 3 repeats, read-only source/modules and network disabled: passed.
• Full make check and make race (Go 1.27.1): passed.
• Independent read-only implementation and regression-oracle review: no actionable findings.

No protocol, dependency, listener default, deployment, tag or release changes.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.