pnpm run forwards everything after the script name to the script verbatim,
including the -- separator itself, so the create-release-pr workflow's
`pnpm run bump -- --release <product>` invocations delivered a literal --
as the first argument and the fail-closed parser rejected it.
parseSelectedProducts now skips a single leading --; a -- in any other
position, and any other unrecognized token, still fails closed.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
