fix(ls): parse arguments through the tokenizer - #3999

The bug

ls.rs::run() classified arguments with raw prefix scans — is_short_flag was
starts_with('-') && !starts_with("--"), flags were .filter(|a| a.starts_with('-')) and
paths the complement — and never called restore_double_dash. With no -- awareness and no
grammar, it could not tell a flag from a path that looks like one, nor a flag from its own
value.

Reproducer (verified against GNU coreutils 9.10, LC_ALL=C)

$ touch -- -al
$ ls -- -al          # real ls: lists the file
-al
$ rtk ls -- -al      # before: listed the whole directory, the path was dropped
alpha.txt
always
beta.log
-al

-al was read as the flags -a/-l, so the child ran ls -la ..

Three more from the same cause:

What changed

plan() tokenizes through tokenize_grammar with an ls_takes_value grammar transcribed from
ls --help and verified flag by flag against the real binary:

show_all/show_long/flags/paths now come from TokenKind and Token::is_free_positional(),
and restore_double_dash runs first so the -- the user typed is visible at all.

The child command gains an explicit -- before its path list, which is what fixes rtk ls -- -al
and any path that merely starts with a dash. That boundary would have broken GNU long-option
abbreviations (ls --sor time really does sort by time), so the grammar resolves them against
the full option list, leaving ambiguous ones (--ign) for ls itself to reject as it does today.

Short-flag clustering is unchanged (Dialect::Posix) and covered: -la, -lA, -lh1.

The grammar is per-platform, and the value side gets the same treatment

-I, -T and -w take a value on GNU but are booleans on BSD — -I prevents -A from
being auto-set for root, -T completes the time with -l, -w prints non-printables raw, and
only -D takes a value there (FreeBSD ls(1),
same on macOS). Applying the GNU table on
macOS read an operand as a value and moved it ahead of the --; BSD's getopt does not permute,
so rtk ls -lT /tmp ran ls -l -T /tmp -- . and listed the current directory as well as /tmp
before failing on --. A Flavor picked from target_os now selects the short-option grammar,
and the tests pin both flavours on any host.

Four more cases where RTK and real ls disagreed, all now matching on output and exit code:

A flag left waiting for its value can only be the last argument, so no path before it can have
been ---protected; it now goes last in the child argv instead of eating the boundary.

Tests

Behavioural tests on the arg -> child-argv pipeline, each confirmed failing against the old
logic and passing after. The headline one:

test_plan_double_dash_makes_following_arg_a_path
  left: ["-la", "--", "."]      # before
 right: ["-l", "--", "-al"]     # after

55 tests in the module, full suite green, clippy clean, rtk ls startup 7.8 ms.