feat: harden CLI contract and flow resolution

[tbrandenburg]

Issue fixed

Closes #44

Summary

• Make run mandatory and keep execution arguments/options on the subcommand.
• Standardize public options on kebab-case; replace --flow with --tab and --format with --output payload|message.
• Resolve flow files deterministically from exact paths, cwd, or authoritative --flow-dir; remove directory discovery.
• Remove --flow-json @path and update help, README, and unit/integration coverage while preserving runtime and Docker option plumbing.
• Adversarial review found and fixed empty --flow-json falling back to file execution; regression tests cover empty input with and without positional arguments.

Validation

• make ci — Prettier, ESLint, and 122 tests passed. The make target ignored the audit failure; npm audit reported the same baseline 15 dependency advisories (9 moderate, 6 high).
• Focused tests: node --test test/integration/cli.integration.test.js test/unit/flow-file.unit.test.js test/unit/cli-params.unit.test.js — 27 passed before the review fix; the updated CLI integration test also passed after it.
• Manual global CLI E2E: make install-global; executed 25 acceptance assertions covering help/version, mandatory run, default/cwd/flow-dir/explicit paths and no-fallback cases, --tab, inline/stdin/empty/@path flow JSON, output modes, user-dir modes, and rejection of removed syntax. Successful invocations returned 9; message mode returned JSON with payload 9.
• git diff --check passed.

Risks / follow-ups

• Intentional breaking CLI contract change as specified in Harden CLI contract and simplify flow resolution before adding new commands #44.
• Docker daemon-backed execution was not run; Docker option help/plumbing and non-Docker boundaries are covered by existing tests.
• No unrelated issues found.