when using `npm run cdk ...` parameters are eaten by npm unless `npm run cdk -- ...` is used.

### Describe the bug

`cdk diff --fail` doesn't do anything, whether it's set to `true`, `false`, or nothing.

### Expected Behavior

`--fail` should work exactly like `git diff --exit-code` - if there is a diff, the exit code should be non-zero.

### Current Behavior

The exit code is always zero, making the flag useless.

### Reproduction Steps

See log below.

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.93.0 (build 724bd01)

### Framework Version

_No response_

### Node.js Version

v18.17.1

### OS

NixOS

### Language

Typescript

### Language Version

5.2.2

### Other information

Log:

```console
$ npm run cdk diff --fail=true

> @linz/hydro-aws-ci-infrastructure@0.1.0 cdk
> cdk diff

Stack ContinuousIntegration
Resources
[~] AWS::IAM::ManagedPolicy CiExecPolicy CiExecPolicyD0969051
└─ [~] PolicyDocument
└─ [~] .Statement:
└─ @@ -33,7 +33,6 @@
[ ] "sqs:*",
[ ] "ssm:*",
[ ] "states:*",
[-] "tag:*",
[ ] "waf-regional:*",
[ ] "waf:*",
[ ] "wafv2:*"

✨ Number of stacks with differences: 1

$ echo $?
0
$ npm run cdk diff --fail=false

> @linz/hydro-aws-ci-infrastructure@0.1.0 cdk
> cdk diff

Stack ContinuousIntegration
Resources
[~] AWS::IAM::ManagedPolicy CiExecPolicy CiExecPolicyD0969051
└─ [~] PolicyDocument
└─ [~] .Statement:
└─ @@ -33,7 +33,6 @@
[ ] "sqs:*",
[ ] "ssm:*",
[ ] "states:*",
[-] "tag:*",
[ ] "waf-regional:*",
[ ] "waf:*",
[ ] "wafv2:*"

✨ Number of stacks with differences: 1

$ echo $?
0
```

Reproduce the reported commands with `npm run cdk diff --fail=true` and with the `--` separator, then inspect the CDK CLI `diff` entry point and its argument handling. Done means the flag reaches `cdk diff` when invoked through npm and produces a non-zero exit code when differences are found.

Written by the indexing model from the issue text.