Validate filter programs after the option terminator #513

🤖 Generated by the Agentic Engineer

Problem and evidence

The read-only command guard stops inspecting filter content after an option terminator. An offline fixture demonstrates that a normally refused jq program is admitted in that form and can read a synthetic environment canary.

Expected outcome

Ending option parsing must not exempt the program operand from read-only classification. The same program must have the same classification in every supported argument form.

Acceptance criteria

• Reproduce the admitted and rejected forms with the native filter command.
• Validate the program after an option terminator.
• Preserve supported literal filters and reject unresolved program operands.
• Retain environment and file-access restrictions.
• Run guard and installed adapter tests.

Rough size: S. Part of #223.