Harden the CLI Usage Gate Against False Greens #2831

Follow-up hardening of tests/test_cli_usage.py, found by the local review pass on the #2285 branch.

• The unknown-flag case passes on "bogus-flag" in output or "usage" in output.lower(). A script that treats --bogus-flag as a file target, prints "cannot read --bogus-flag", and exits 1 passes. For scripts that need a subcommand (carry, pr_review, canonical_review, local_review, handoff, resolve_description) the refusal observed is the missing argument, not the unknown flag.
• The help case accepts any stdout containing "usage" with exit 0 and no stub call, so a default-mode report mentioning "usage" passes.
• tree_state uses git status --porcelain=v1 -uall, which omits ignored paths, so a write into an ignored directory goes unseen.
• Only HOME, APPDATA and LOCALAPPDATA are redirected. XDG_CONFIG_HOME and the tool-specific config-home variables pass through from the operator's environment.
• Connections and stub calls are counted only while the direct child runs, so a detached grandchild is not seen.
• spec/resolve_description.py now takes NAME as an argparse positional, so a name starting with - is read as an option, and repo-config/configure.sh passes "$name" without --.