`fallout-migrate` silently ignores unknown options and migrates the working directory

@
## Problem

`Fallout.Migrate` never enables Spectre.Console.Cli strict parsing, and Spectre defaults to lenient. Unrecognized options are silently discarded and the command runs with defaults — meaning a **full destructive migration of the resolved working directory**, exit code 0, no error.

Verified with the 10.4.0-rc.5 tool against a throwaway repo. All three of these rewrote `_build.csproj` and renamed `.nuke` → `.fallout`:

```
fallout-migrate --version
fallout-migrate -v
fallout-migrate --bogus-flag
```

`--version` is the dangerous one: it is the reflex for checking which tool build you have, there is no such option (`Program.cs` never calls `SetApplicationVersion`), and instead of telling you that it migrates your repo. This rewrote 57 tracked files in a Fallout working tree during investigation, mangling the `Nuke.*` transition shims under `src/Shims/` into `Fallout.*`.

`ConfirmMigrationStep` is only a partial backstop — it returns early when `Console.IsInputRedirected`, so CI, scripts, piped stdin, and agent invocations get no prompt at all. When it does prompt, the message does not mention that an argument was ignored.

`git grep StrictParsing` returns nothing on either `main` or `release/v10.4`.

## Outcome

An unrecognized option is a hard error that changes nothing on disk, and `--version` reports the tool version.

## Acceptance criteria

- [ ] `config.Settings.StrictParsing = true` — unknown options exit non-zero and write no files
- [ ] `config.SetApplicationVersion(...)` so `--version` prints the version and exits
- [ ] Tests cover: unknown option → non-zero exit, zero files touched; `--version` → version, no migration
- [ ] Consider auditing other Spectre entrypoints (`Fallout.Cli`) for the same lenient default
- [ ] Backported to `release/v10.4`
@

Start in Program.cs and inspect the Fallout.Migrate configuration, including StrictParsing and SetApplicationVersion, then review ConfirmMigrationStep and the Fallout.Cli entrypoint for the same behavior. Add coverage for an unknown option and --version, verifying non-zero or version output with no files changed, then check the release/v10.4 backport.

Written by the indexing model from the issue text.