CLI silently accepts unknown tool flags — silent-wrong output (trace_path --max-depth ignored) #997

Found during a GF1 agent evaluation: cli trace_path ... --max-depth 1 succeeded but traced at the default depth 3 — the supported flag is --depth. cbm_cli_build_args_json types unknown flags as strings and ships them as JSON args the server ignores, so the caller gets silently-wrong output (the eval consumed ~5.4K output tokens of unwanted hop-2/3 rows and mis-read the graph).

Fix (reproduce-first, ready locally): reject unknown flags for known tools with a loud error naming the nearest valid flag (Levenshtein suggestion): unknown flag --max-depth for this tool (did you mean --depth?) — run 'cli trace_path --help' for the supported flags. Raw-JSON, --args-file, stdin, and supervisor worker argv paths are unaffected (they bypass the flag converter). RED test cli_build_args_json_unknown_flag_rejected fails on current main, passes with the fix; CLI suite 119/119.