fix(cli): --read-only silently dropped when --cwd follows it

[Vyacheslav-Tomashevskiy]

The bug

--read-only is documented as the safe-first-run switch ("blocks write, shell, commit, and clipboard-copy tools"). It stops working as soon as a --cwd follows it on the command line:

python3 trashclaw.py --read-only --cwd ~/project   # read-only silently OFF
python3 trashclaw.py --cwd ~/project --read-only   # read-only ON

main() handles --cwd by reloading the project config, and _apply_config() unconditionally rewrites READ_ONLY_MODE, APPROVE_SHELL and LLAMA_URL from the config/env defaults — so every flag parsed before that --cwd is thrown away. --read-only sets the global at parse time, then the reload sets it straight back to "0".

Consequence: the agent is handed write_file, edit_file, patch_file, run_command and git_commit in a session the user explicitly asked to be an audit, with no warning. Same mechanism silently drops --url (prompts go to the default endpoint instead of the one you named) and --auto-shell.

Reproduced before and after

Driving the real main() with agent_turn stubbed, on a clean checkout of main:

argv	read_only	tools exposed	blocks write_file
--read-only	True	12	True
--read-only --cwd P	False	17	False
--cwd P --read-only	True	12	True
--url http://box:9999 --cwd P	—	—	url reset to http://localhost:8080

With this patch all rows behave like the first one.

The fix

Remember what the flags asked for and re-apply it after each config reload, so flag order stops mattering. Project config still wins for anything the CLI did not set — a .trashclaw.json with read_only: true and no flags still enables read-only (covered by a test).

Tests

New tests/test_cli_flags.py — pytest + stdlib only, no LLM server contacted (agent_turn is stubbed, -e path). Three cases: read-only survives in both flag orders and both --cwd spellings; --url/--auto-shell survive; project config still applies.

• With the patch: 3 passed.
• Reverting the patch: the two regression tests fail (assert False is True, 'http://localhost:8080' == 'http://box:9999') — non-vacuous.
• Full suite: 326 passed, 4 failed; those same 4 (test_metal_gpu x3, test_wordcount_base64::test_count_file) fail identically on unpatched main on this Linux host, so this PR adds no new failures.

The existing read-only tests only exercise _read_only_blocked() with the global monkeypatched, which is why the CLI wiring was never covered.

RTC: RTCd1554f0f35576faf01d386a6be1c947f560dd0b7