Make the refused --worktree flag pairs unrepresentable

[adamw]

--worktree cannot be combined with --skip-branch or with --keep-changes.
Both pairs were refused at runtime, but nothing stopped code from building one:
OrcaArgs carried three independent Flag fields, and the shell's FlowFlags
three independent Booleans, built at four launch sites.

The three flags now become one value once argv is parsed:

enum RunTarget:
  case NewBranch(uncommitted: Uncommitted)      // Stash | Keep
  case CurrentBranch(uncommitted: Uncommitted)
  case Worktree

Worktree carries neither a branch mode nor an Uncommitted, so the five legal
combinations are the only ones that can be written.

What is now impossible

• The refusal inside flow() is gone. It was there because an OrcaArgs
  built by hand had never been through the parser. Such an OrcaArgs can no
  longer hold a refused pair, so there is nothing left to check.
• A launch path cannot be handed a refused pair. FlowFlags holds a
  RunTarget, so the four sites that build one (menu run, resume, flow
  authoring, orca run) cannot spawn a flow child that would refuse its own
  argv.
• One type, not two. The shell had its own three-case RunTarget for the
  menu; it is folded into the shared one rather than left as a second enum
  meaning the same thing.
• One home for the flag spelling. RunTarget.toArgv renders the flags the
  shell appends after --, next to the @arg annotations that parse them back.

What is still representable, and why

mainargs builds a case class straight from argv, so raw Flag fields have to
exist at the parse boundary. They moved to RawArgs, private to package orca, whose only consumer is OrcaArgs.parse. orca run has the same
boundary — its own mainargs @main flags — and converts them the same way.
Both conversions go through RunTarget.from, the single place a refused pair is
worded and rejected. So argv can still say --worktree --skip-branch; nothing
past those two conversions can.

One derived pair of booleans is left: DirtyTreeFacts(skipBranch, keepChanges),
the dirty-tree policy's input, now filled from target.skipBranch /
target.keepChanges. It has no worktree field, so it cannot express a refused
pair either.

ParserForClass[OrcaArgs] is no longer given, since OrcaArgs is no longer the
parser's type. Flow scripts keep writing flow(OrcaArgs(args)).

No behaviour change

Same flags, same refusal wording and precedence (--worktree --keep-changes
still names only those two), same exit codes, same argv passed to the flow
child.

sbt scalafmtAll clean, sbt test green: 2238 tests, 0 failures.