fix: [nomad-step-0] S0.1-fix — bin/disinto swallows --backend=nomad as repo_url positional (#835)

Why: disinto_init() consumed $1 as repo_url before the argparse loop ran,
so `disinto init --backend=nomad --empty` had --backend=nomad swallowed
into repo_url, backend stayed at its "docker" default, and the --empty
validation then produced the nonsense "--empty is only valid with
--backend=nomad" error — flagged during S0.1 end-to-end verification on
a fresh LXC. nomad backend takes no positional anyway; the LXC already
has the repo cloned by the operator.

Change: only consume $1 as repo_url if it doesn't start with "--", then
defer the "repo URL required" check to after argparse (so the docker
path still errors with a helpful message on a missing positional, not
"Unknown option: --backend=docker").

Verified acceptance criteria:
  1. init --backend=nomad --empty             → dispatches to nomad
  2. init --backend=nomad --empty --dry-run   → 9-step plan, exit 0
  3. init <repo-url>                          → docker path unchanged
  4. init                                     → "repo URL required"
  5. init --backend=docker                    → "repo URL required"
                                                (not "Unknown option")
  6. shellcheck clean

Tests: 4 new regression cases in tests/disinto-init-nomad.bats covering
flag-first nomad invocation (both --flag=value and --flag value forms),
no-args docker default, and --backend=docker missing-positional error
path. Full suite: 10/10 pass.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

tests/disinto-init-nomad.bats

@@ -104,3 +104,42 @@ setup_file() {
   [ "$status" -ne 0 ]
   [[ "$output" == *"--empty is only valid with --backend=nomad"* ]]
 }
+
+# ── Positional vs flag-first invocation (#835) ───────────────────────────────
+#
+# Before the #835 fix, disinto_init eagerly consumed $1 as repo_url *before*
+# argparse ran. That swallowed `--backend=nomad` as a repo_url and then
+# complained that `--empty` required a nomad backend — the nonsense error
+# flagged during S0.1 end-to-end verification. The cases below pin the CLI
+# to the post-fix contract: the nomad path accepts flag-first invocation,
+# the docker path still errors helpfully on a missing repo_url.
+
+@test "disinto init --backend=nomad --empty --dry-run (no positional) dispatches to nomad" {
+  run "$DISINTO_BIN" init --backend=nomad --empty --dry-run
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"nomad backend: --empty (cluster-up only, no jobs)"* ]]
+  [[ "$output" == *"[dry-run] Step 1/9: install nomad + vault binaries"* ]]
+  # The bug symptom must be absent — backend was misdetected as docker
+  # when --backend=nomad got swallowed as repo_url.
+  [[ "$output" != *"--empty is only valid with --backend=nomad"* ]]
+}
+
+@test "disinto init --backend nomad --dry-run (space-separated, no positional) dispatches to nomad" {
+  run "$DISINTO_BIN" init --backend nomad --dry-run
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"nomad backend: default"* ]]
+  [[ "$output" == *"[dry-run] Step 1/9: install nomad + vault binaries"* ]]
+}
+
+@test "disinto init (no args) still errors with 'repo URL required'" {
+  run "$DISINTO_BIN" init
+  [ "$status" -ne 0 ]
+  [[ "$output" == *"repo URL required"* ]]
+}
+
+@test "disinto init --backend=docker (no positional) errors with 'repo URL required', not 'Unknown option'" {
+  run "$DISINTO_BIN" init --backend=docker
+  [ "$status" -ne 0 ]
+  [[ "$output" == *"repo URL required"* ]]
+  [[ "$output" != *"Unknown option"* ]]
+}