fix(run): classify portfolio-mode flags by allowlist so a new flag fails closed

The portfolio entrance refused unsupported flags from a hard-coded BLOCKLIST:
--inbox, --out, --outbox, --run-id, --value-report, --live-dry-run. That
construction fails OPEN. A flag added to the parser later and forgotten in the
list is accepted, does nothing, and says nothing — the operator's flag is a
claim the run does not back (§1). MAF's report mode already used an allowlist;
the divergence was raised as an open question and the operator decided it this
session in favour of fail-closed.

unsupported_flags_given() now reports every flag GIVEN that the allowlist does
not name. "Given" is measured against the parser's own default, so it needs no
knowledge of which flags exist — that is what keeps it correct for flags added
after it was written, including store_true switches.

Load-bearing (§11), detach-proven twice (before and after ruff format, restored
from a copy): swapping the membership test back to a hard-coded refusal list
turns test_a_flag_nobody_classified_is_refused RED, while every CLI-level
refusal test stays green — they only exercise flags a blocklist already names,
so they do not cover this seam. The other direction is covered too: a run
passing all fourteen honoured flags still exits 0, and the allowlist entries
are checked against the CLI's own --help so a rename cannot leave a dead entry.

612 -> 624 passed, ruff + mypy --strict clean. README states the allowlist.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MQu2xxwedckjU56byu1aUG

README.md

@@ -133,7 +133,9 @@ description, never from its code)
   nothing** — it returns typed results and prints one line per project, because the outbox
   names its pairs by `run_id` and a portfolio pass has none of its own. Rather than accept
   `--outbox`/`--out`/`--value-report` and quietly ignore them, the entrance refuses them
-  there and points at the per-project `--bundle` runs (§1).
+  there and points at the per-project `--bundle` runs (§1). The refusal is an **allowlist**:
+  it names the flags the portfolio pass acts on, so a flag added later and classified nowhere
+  is refused rather than silently ignored — fail-closed, not fail-quiet.
 - `run_s10.py` — the programme's ONE live run (cost discipline D6); run-path only.
 - `costsim.py` — pre-run cost simulation (**offline** — the one Run-layer module that never
   touches the network): a deterministic UPPER-BOUND USD estimate for a (portfolio-)run