`aspire run` silently accepts unknown/misspelled flags (e.g. `--isol`) instead of failing

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Describe the bug

`aspire run` does not reject unknown or misspelled options. Typing `--isol` (a typo of `--isolated`) — or even an obviously bogus flag like `--totally-bogus-flag` — produces no parser error. The bad token is silently swallowed and the command proceeds as if it weren't there, so a user who fat-fingers `--isolated` gets a normal (non-isolated) run with no indication their flag was ignored.

Root cause is that `RunCommand` sets `TreatUnmatchedTokensAsErrors = false` so any token not matching a known option is collected into `UnmatchedTokens` and forwarded to the AppHost. That passthrough is intentional for `aspire run [options] [[--] ...]`, but it also applies to typo'd flags placed *before* any `--`, hiding user errors.

Closely related to #18371 (`--AppHost` casing is silently ignored); both stem from the same "unknown tokens are never an error" behavior.

### Expected Behavior

An unrecognized option before the `--` passthrough separator should produce an error, e.g. `Unrecognized command or argument '--isol'`, rather than being silently ignored. Tokens after `--` should still be forwarded to the AppHost.

### Steps To Reproduce

```bash
# In a directory with no AppHost, compare the three — output is identical,
# proving --isol and --totally-bogus-flag are not rejected by the parser:
aspire run
aspire run --isol
aspire run --totally-bogus-flag
```

All three print only the missing-AppHost error; none reports the unknown flag:

```
Finding AppHosts...
❌ The project argument was not specified and no AppHost project files were detected.
```

`aspire run --help` confirms `--isolated` is a real option, so `--isol` is a misspelling that should not be silently accepted.

### Environment

- Aspire CLI `13.4.6+87fe259e4fc244c599019a7b1304c85a1488f248`
- macOS (Darwin)

Start at the RunCommand entry point and inspect how TreatUnmatchedTokensAsErrors and UnmatchedTokens handle arguments before and after the -- separator. Reproduce with aspire run --isol and aspire run --totally-bogus-flag, then verify that unknown pre-separator options error while tokens after -- still reach the AppHost.

Written by the indexing model from the issue text.