Refuse an argument this copy does not know, rather than ignoring it

`dejima-guard report` and `dejima-guard report --finding` gave identical output
on a live host, which read as the new flag doing nothing. What it did was not
exist there: the container had the previous image, whose dispatch was
`report) cmd_report ;;` and dropped every argument before the function saw one.

A container makes that state easy to be in and hard to notice, because `git
pull` changes the checkout and not the image. Silently ignoring the flag is what
turned "you are running an older copy" into "this feature is broken".

An unknown argument is an error now, and the message says which copy is
answering and how to replace it. That is the whole value: the failure diagnoses
itself instead of looking like a defect in the thing being asked for.

bin/dejima-guard

@@ -717,6 +717,27 @@ cmd_test_alert() {
 }
 
 cmd_report() {  # cmd_report [--finding]
+    # AN ARGUMENT THIS COPY DOES NOT KNOW IS AN ERROR, not something to ignore.
+    #
+    # The version before --finding existed dropped every argument at the
+    # dispatch, so `report --finding` printed the last report and looked like
+    # the flag had worked. An operator comparing the two commands saw identical
+    # output and reasonably concluded the feature did nothing, when what it did
+    # was not exist yet in the copy they were running.
+    #
+    # A container makes that easy to be in: `git pull` changes the checkout and
+    # not the image. So an unknown argument says which copy this is.
+    case "${1:-}" in
+        ""|--finding) ;;
+        *) die "unknown argument for report: $1
+
+This copy knows --finding and nothing else. If you expected a flag that is not
+listed, the program answering you is older than the one you read about:
+
+  docker compose up --build -d     # a container
+  sudo ./install.sh                # a host install" ;;
+    esac
+
     if [ "${1:-}" = "--finding" ]; then
         [ -r "$FINDING" ] || { say "no cycle has found anything yet"; return 0; }
         cat "$FINDING"

test/guard.bats

@@ -1350,3 +1350,35 @@ PORT tcp 0.0.0.0:4444" 0
     run_watch report --finding
     [[ "$output" == *"no cycle has found anything yet"* ]]
 }
+
+@test "an argument report does not know is an error, not a no-op" {
+    # The version before --finding dropped every argument at the dispatch, so
+    # `report --finding` printed the last report and looked like the flag had
+    # worked. Identical output from two different commands reads as the feature
+    # doing nothing, when what it did was not exist in the copy being run.
+    stub_ssh "FILE aaa /etc/one" 0
+    run_watch accept
+    run_watch check
+    run_watch report --findings          # a plausible typo
+    [ "$status" -ne 0 ]
+    [[ "$output" == *"unknown argument"* ]]
+}
+
+@test "the unknown-argument message says how to get a newer copy" {
+    # A container makes this easy to be in: git pull changes the checkout and
+    # not the image.
+    stub_ssh "FILE aaa /etc/one" 0
+    run_watch accept
+    run_watch check
+    run_watch report --whatever
+    [[ "$output" == *"--build"* ]]
+    [[ "$output" == *"install.sh"* ]]
+}
+
+@test "report with no argument is still fine" {
+    stub_ssh "FILE aaa /etc/one" 0
+    run_watch accept
+    run_watch check
+    run_watch report
+    [ "$status" -eq 0 ]
+}