polish: trim unknown-arg echo, document trace artifacts and unverified selectors

Addresses whole-branch review's minor findings:
- Unknown CLI arguments now echo only the flag name, not its value, so a
  mistyped flag (e.g. --pasword=secret) can't leak a credential into the
  error output.
- README now notes that failed runs retain a screenshot/trace under
  test-results/ (gitignored, may contain the username but not the masked
  password), and points at the UNVERIFIED post-composer selectors as the
  first thing to check during real home-network verification.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

sidecars/reddit-post/README.md

@@ -19,3 +19,19 @@ failure:
 
     {"success": true, "url": "https://www.reddit.com/r/test/comments/.../"}
     {"success": false, "error": "Login did not complete — possible CAPTCHA or 2FA prompt"}
+
+## Notes
+
+- On a failed run, Playwright retains a screenshot and trace under
+  `test-results/` for debugging (`npx playwright show-trace test-results/.../trace.zip`).
+  These are gitignored and not committed, but they persist on disk and may
+  contain the username you passed in (the password field is masked in the
+  browser, so its value isn't captured). Clear `test-results/` if you want
+  to remove them.
+- The post-composer selectors (text-post tab, title/body fields, submit
+  button) are marked `UNVERIFIED` in `tests/reddit-post.spec.js` — they've
+  only been confirmed as far as this sidecar's original development
+  environment could reach live Reddit before being network-blocked. If a
+  real run on your own network fails after a successful login, start by
+  checking those selectors with:
+  `npx playwright codegen https://www.reddit.com/r/test/submit`