Addresses whole-branch review's minor findings:
- Unknown CLI arguments now echo only the flag name, not its value, so a
mistyped flag (e.g. --pasword=secret) can't leak a credential into the
error output.
- README now notes that failed runs retain a screenshot/trace under
test-results/ (gitignored, may contain the username but not the masked
password), and points at the UNVERIFIED post-composer selectors as the
first thing to check during real home-network verification.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
