Before: `./setup --help` silently ran the full installer because the arg
parser's catch-all (`*) shift`) swallowed unknown flags.
After: `-h`/`--help` print a usage banner and exit 0. The check runs
before the bun availability guard so the flag is discoverable on a fresh
machine.
Tests: test/setup-help.test.ts covers the usage function, ordering vs the
bun check, flag coverage, and live invocation of both `./setup --help`
and `./setup -h`. Existing setup-codesign tests unaffected.
Fixes#1133
saen-ai