fix: harden CLI receipts and preview watching

[testikun]

Summary

Fixes #311, #305, and #310:

• Preserve validation output larger than 64 KB.
• Reject invalid flags and extra positional arguments in check, examples, doctor, and demo.
• Normalize the watched directory before starting the Windows preview watcher.

Validation

60 focused tests pass, including the CLI and preview regression suites. The required ablation experiment confirmed all three changes are necessary.

[sunsunsun-java]

1. 更新分发 ZIP——需要修改
   本次修改了三个运行时文件，但 archify.zip 尚未同步。我们使用同一份输入验证：源码版校验成功，ZIP 解压版仍报 JSON at position 65536，因此通过 ZIP 安装的用户无法获得修复。请使用仓库规定的 Node 22 构建流程重建并提交 ZIP，同时验证解压后的实际安装包。

2. 补充针对性回归测试——需要修改
   请为这三项行为修复补充能在修复前失败、修复后通过的回归测试。现有测试通过尚不能覆盖本次触发条件：

• [Bug]: artifact-check receipt > 64 KB is truncated by process.exit() after console.log — validate/deliver/compare fail with "JSON at position 65536" #311：超过 64 KiB 的回执经过 pipe 后仍能完整解析，并保持正确的成功／失败退出码，覆盖实际 CLI 消费路径。
• [Bug]: Remaining CLI commands accept invalid arguments and demo writes to a typo option path #305：四个命令拒绝未知长选项及多余位置参数，且不生成目录或文件。
• [Bug]: fs.watch-based live preview crashes with a native libuv assertion on short-name-aliased Windows paths #310：验证 Windows 短路径目录的规范化与监听行为；若尚无 Windows 实机验证，请明确记录这一限制。
  请在 PR 描述中补充具体测试命令和结果。

3. 明确 1 MiB 容量边界——需要说明范围
   另外发现一个既有容量边界：runNode() 使用的 spawnSync 仍受默认 1 MiB 缓冲上限约束。实测 checker 返回 9/9 通过、回执为 1,148,021 字节时，validate、deliver、compare 均因内部 ENOBUFS 失败。
   这不是本 PR 引入的新回归，但意味着“不受回执大小影响”的要求尚未完全实现。请明确本 PR 是否同时处理该边界；若本次仅修复 process.exit() 导致的截断，建议在描述中注明剩余限制，并另行跟踪容量问题。

[YunyueLi]

The #311 portion of this PR is now superseded by the more focused PR #321, which includes dedicated large-receipt regressions, a rebuilt distribution ZIP, and passing cross-platform CI. This branch still has the same remaining >1 MiB spawnSync buffer boundary because its #311 change is also limited to replacing process.exit() with process.exitCode.

Independent reproduction against the #321 implementation produced a 1,084,196-byte valid checker receipt: direct file output exited 0, while the internal pipe returned ENOBUFS; validate, deliver, and compare all exited 1. The same runNode() path is unchanged here.

Recommendation:

• remove [Bug]: artifact-check receipt > 64 KB is truncated by process.exit() after console.log — validate/deliver/compare fail with "JSON at position 65536" #311 from this PR and let fix(checker): flush large artifact receipts before exiting #321 own that fix;
• split [Bug]: Remaining CLI commands accept invalid arguments and demo writes to a typo option path #305 and [Bug]: fs.watch-based live preview crashes with a native libuv assertion on short-name-aliased Windows paths #310 into focused PRs, or update this branch with the already-requested regression tests, Windows evidence, distribution ZIP rebuild, and current-main merge;
• do not merge this branch as an alternative [Bug]: artifact-check receipt > 64 KB is truncated by process.exit() after console.log — validate/deliver/compare fail with "JSON at position 65536" #311 repair in its present state.

This keeps the receipt fix reviewable and avoids merging overlapping implementations with different validation coverage.