Require -- before a remote command in ssh/exec and deprecate the positional heuristic

Why

Since 0.1.1, farrow ssh metaa -- uptime is refused because the token before -- must be a known node. Without --, the first token is still treated as a node only when it names one, so farrow ssh metaa uptime runs metaa uptime on the control node. That is harmless in practice (command not found) but the grammar stays ambiguous, and the help text has to explain two rules.

Proposed shape

• 0.1.x: when there is no -- and the first token is not a node, print once warning: treating "metaa" as a remote command; write farrow ssh [node] -- command.
• 0.2: the grammar becomes farrow ssh [node] [-- command...] and farrow exec [node] -- command...; a non-node token before any command is a usage error (exit 2).

Acceptance

• farrow ssh uptime warns in 0.1.x and exits 2 in 0.2; Use lines, README, and the site examples are updated together.

Start by locating the ssh and exec command parsers and their Use lines, then review the README and site examples for the existing invocation forms. Check how node detection, warnings, and exit status are currently handled. Done means the 0.1.x warning and 0.2 usage error match the proposed grammar, with all listed documentation updated together.