Reject unknown values passed to --debug-wave

## Current evidence

`DebugFlags::apply` in `src/flags.rs` recognizes `tokens`, `ast`, `ir`, `mc`, `hex`, and `all`, but its fallback branch silently ignores every other value. `src/cli.rs` accepts both `--debug-wave=` and `--debug-wave ` without checking whether every requested mode was recognized.

A typo such as `--debug-wave=toknes` therefore succeeds while enabling nothing, which makes the command line appear valid even though the requested diagnostic mode was not applied.

## Scope

- Reject unknown debug modes with a normal CLI usage error.
- Preserve comma-separated valid modes and `all`.
- When a list mixes valid and invalid values, report the invalid value instead of partially accepting the option silently.
- Keep the existing debug modes and their behavior unchanged.

## Completion criteria

- CLI tests cover a valid single mode, a valid comma-separated list, an unknown mode, and a mixed valid/invalid list.
- Both `--debug-wave=value` and `--debug-wave value` use the same validation.
- Invalid input exits through the existing usage-error path.

Start in src/flags.rs at DebugFlags::apply and compare its recognized modes with argument handling in src/cli.rs. Run or extend the CLI tests for valid single and comma-separated modes, unknown and mixed values, and both option forms; done means invalid input follows the existing usage-error path while valid modes and all retain their behavior.

Written by the indexing model from the issue text.