fix(pm): check-clause2-carriers names the board's SOURCE, answers --help, and refuses an argument it does not honour (#16699)

The board was already a parameter — `resolveSweepRepo` (imported from
check-half-states.mjs) resolves PM_SWEEP_REPO, else GITHUB_REPOSITORY, else the
default, and returns `source` alongside `repo`. The run simply never printed
`source`, so a deliberate target and the fallback rendered as the same sentence,
and a seat reading only this script concluded the board was hard-scoped.

Three changes, one file:

1. Every run opens with a provenance line naming the board AND on what basis it
   is the board, on stderr in every mode (stdout stays contractually the answer),
   printed before the first request so a run that dies in transport has still
   said which board it was about.
2. `--help` / `-h` print usage and exit 0 before any network read. The usage text
   carries the env precedence, so the one action a seat takes to discover the
   mechanism no longer hides it behind a sweep.
3. An argument this file does not honour is refused before any read, naming it
   and printing the usage, exiting 1 — the register's usage code, deliberately
   not dispatch-gates' 2, which here is the UNJUDGED verdict.

A KNOWN_FLAGS table is the single source for both the parse and the usage text:
every parse site looks its flag up through `flagIndex`, which throws on a flag
absent from the table, so a flag the tool honours and does not document is
unreachable rather than merely unlikely. A repo-shaped positional is pointed at
PM_SWEEP_REPO — the confusion this change exists to end.

No verdict, row, reader or `--pair` semantics changed. 42 self-test cases added
(251 pass, was 209).


Claude-Session: https://claude.ai/code/session_018dxq7YqsLDMeZDZ5AzsgJX

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

Author: os-musk