[codegen] Reject unknown OpenAPI and RPC CLI flags

[kang-heewon]

Priority

P1

Problem

The OpenAPI and RPC codegen CLIs parse known flags by lookup but do not reject leftover unknown flags. Misspelled public options are silently ignored and generation/checking can report success with materially different behavior.

Evidence

• packages/openapi-spec/src/libs/cli.ts and packages/rpc-codegen/src/libs/cli.ts consume known flags without validating the full argv set.
• Existing CLI tests cover required/conflicting known flags, not unknown options.
• This is separate from committed-output drift issue [codegen] Detect committed OpenAPI and RPC drift without rewriting outputs #1322 and was found by [quality] Audit the 1.0 spine for silent-success public contracts #1332.

Acceptance criteria

• Reject every unknown flag with a stable non-zero diagnostic.
• Reject unexpected positional values where unsupported.
• Add regression tests to both CLIs, including close misspellings of destructive/output flags.
• Preserve documented compatibility flags.

Parent: #1332