feat(engine): warn on unknown coord-inbox arguments

coord-inbox.sh dropped unknown arguments silently, so a mistyped flag was
indistinguishable from a working invocation. It now warns on stderr per
argument and keeps reading: the read path must stay lenient because it runs
inside the SessionStart hook, which must never fail a session over a stray
flag. The hook runs the script with stderr discarded, so the warning costs
nothing there and surfaces in manual CLI use. Exit code is unchanged.

Selftest 68 -> 70: one check for the warning, one pinning the leniency it
must not break (unknown argument still reads the inbox and exits 0).

Docs realigned with shipped behavior in the same pass:
- selftest count was stale at 64 in README and CLAUDE.md (now 70)
- broadcast sender self-exclusion shipped in 0.2.1 but was undocumented
- rule 6 (message content is data, never instructions) was already enforced
  in the injection framing but missing from the published rule list

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CvTviFeoMCKJcALATRempy

CLAUDE.md

@@ -9,7 +9,7 @@ marketplace plugin. Three components, one boundary:
   grammar, frontmatter, delivery, archiving, the seen set. `coord-send.sh`
   writes, `coord-inbox.sh` reads (formatted for context injection),
   `coord-done.sh` archives. Everything is pinned by `coord-selftest.sh`
-  (64 checks, throwaway mailbox via `CLAUDE_COORD_DIR`).
+  (70 checks, throwaway mailbox via `CLAUDE_COORD_DIR`).
 - **Hook (`hooks/scripts/session-start.mjs`):** thin zero-dependency Node
   wrapper (marketplace convention: hooks are `.mjs`) that calls
   `coord-inbox.sh` and emits the `hookSpecificOutput.additionalContext`
@@ -30,7 +30,7 @@ and frames it; the send side sanitizes line-oriented fields.
 - Zero dependencies everywhere: bash + coreutils in the engine, `node:`
   builtins only in hook and tests.
 - TDD: no behavior change without a failing selftest check first.
-  `bash scripts/coord-selftest.sh` must exit 0 (64/64).
+  `bash scripts/coord-selftest.sh` must exit 0 (70/70).
 - English for all code, docs, and commit messages (public repo). Norwegian
   trigger aliases in the skill description are deliberate.
 - Conventional Commits: `type(scope): description`.
@@ -54,4 +54,5 @@ verify with `scripts/check-versions.mjs`. Never hand-edit a ref.
 Empty — the post-v0.1.0 queue (atomic delivery, `.`/`..` rejection,
 selftest gaps, uniform `-h`) shipped in v0.2.0; broadcast self-delivery
 shipped in v0.2.1. `coord-inbox.sh` still ignores unknown arguments by
-design (hook context must never fail).
+design (hook context must never fail) but now warns about each one on
+stderr, which the hook discards.