polish: trim unknown-arg echo, document trace artifacts and unverified selectors

Addresses whole-branch review's minor findings:
- Unknown CLI arguments now echo only the flag name, not its value, so a
  mistyped flag (e.g. --pasword=secret) can't leak a credential into the
  error output.
- README now notes that failed runs retain a screenshot/trace under
  test-results/ (gitignored, may contain the username but not the masked
  password), and points at the UNVERIFIED post-composer selectors as the
  first thing to check during real home-network verification.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

sidecars/reddit-post/run.sh

@@ -20,7 +20,8 @@ for arg in "$@"; do
     --body=*) BODY="${arg#*=}" ;;
     --headed) HEADLESS_FLAG="false" ;;
     *)
-      echo "{\"success\": false, \"error\": \"Unknown argument: $arg\"}"
+      UNKNOWN_FLAG="${arg%%=*}"
+      echo "{\"success\": false, \"error\": \"Unknown argument: $UNKNOWN_FLAG\"}"
       exit 1
       ;;
   esac