framework tools/git: strict value guards + provider-failure normalization family-wide (codex blockers on PR #1464)

- Value guards now reject option-like values: --anything always, and
  single-dash flag shapes (-h, -i). Previously -b --help consumed
  --help as the body and performed the write (codex example:
  issue-close -i --help proceeding to 'Closed GitHub issue #--help').
  Multi-char dash-leading text (-start of a list) stays a legal value.
- Every remaining direct provider exec (gh/tea/CMD arrays across
  issue-create/edit/assign/list/view, milestone-*, pr-create/edit,
  pr-close, issue-close/reopen) wrapped with rc capture and normalized
  to exit 1 with a stderr message — provider exit 2 no longer collides
  with the reserved usage-error status.
- All 16 usage-contract suites gained option-like and short-flag arms
  (16/16 green). Existing suites re-verified; test-pr-edit and
  test-issue-create-interactive-auth fail identically with these
  changes stashed (environment-coupled, not regressions; documented).

packages/mosaic/framework/tools/git/test-issue-comment-usage-contract.sh

@@ -124,6 +124,13 @@ for flag in -i -b -c -l --issue --body --comment --login; do
     expect_stderr "requires a value" "value-less $flag message on stderr"
 done
 
+# 4a. An option-like value is a MISSING value, not a value (codex PR #1464:
+# -b --help previously consumed --help as the body and performed the write).
+expect_rc 2 "option-like value rejected" -i 5 -b --help
+expect_rc 2 "short flag value rejected" -i 5 -b -h
+expect_stderr "requires a value" "short flag value message on stderr"
+expect_stderr "requires a value" "option-like value message on stderr"
+
 # 6. Alias acceptance at parse level: both -b and -c carry a value past
 # parsing; the wrapper then fails at platform detection (not a git repo)
 # nonzero but NOT as a usage error (rc must not be 2).