Refuse a repeated health-judge flag even after a -- flag value #5035

🤖 Generated by the Agentic Engineer

Part of #4756.

Problem

The OpenBao health judge refuses a flag given twice, so a trailing duplicate cannot quietly narrow the expected servers or swap the expected release. Its check stops reading the arguments at the first literal --, even when that -- is the value of a flag. Arguments after it are still parsed, so a later --expect-servers or --expect-version silently replaces the earlier one.

Reaching it needs control of the calling procedure's arguments, so the severity is low. The protected replacement procedure in #4970 will build those arguments, and the guarantee the command states should hold for every argument list.

Outcome

A flag given twice is refused wherever the parser assigns it, including after a -- that is a flag's value. The quorum judge added for #5033 does this by making each flag value refuse a second assignment; the health judge should do the same.

Acceptance criteria

• --expect-servers -- --expect-version -- --expect-servers openbao-0 --expect-version 2.6.3 --input <capture> exits 2.
• Existing argument regressions keep passing.

Rough effort: Small.