Support comma-separated -F for querying multiple facts

`node-lookup -jF ipaddress,enc_role` returned `{}` because it queried a single
fact literally named "ipaddress,enc_role". Requesting several facts per host is
a natural need (e.g. pairing an address with its role).

- Split -F on commas (splitFactNames) and match any of them via an "or" over
  ["=","name",<n>] clauses (nameFilter); a single name keeps the plain "="
  form.
- Key JSON output by each result's real fact name so all requested facts appear
  under the host (previously keyed by the raw -F string).
- Update the -F flag help and add unit tests (split, single vs multi query
  shape, multi-fact JSON).

AGENTS.md

@@ -59,6 +59,7 @@ installed. To load ad-hoc in the current shell, e.g. zsh:
 ./node-lookup -R                          # show all nodes with role fact
 ./node-lookup -n <hostname>               # lookup a specific node
 ./node-lookup -F <fact_name>              # filter by fact name
+./node-lookup -jF ipaddress,enc_role      # several facts at once (comma-separated)
 ./node-lookup -R -m <value>               # exact value match (-m)
 ./node-lookup -R -pm <value>              # partial/regex match (-p -m combined)
 ./node-lookup -R -im <value>              # inverse exact match (-i -m combined)
@@ -111,6 +112,7 @@ Show the active configuration (after all overrides applied):
 
 - **`loadConfig()`**: reads config file → applies env vars → returns `config` struct. Called once at startup in `main()`.
 - **`buildQuery()`**: returns a PuppetDB PQL-compatible JSON array string. Uses `roleFact` from config (not hardcoded). Match modifiers: `-p` (partial/regex, uses `~` op), `-i` (inverse, wraps with `not`), composable.
+- **Multiple facts**: `-F` accepts a comma-separated list (`ipaddress,enc_role`). `splitFactNames()`/`nameFilter()` turn several names into an `or` over `["=","name",<n>]` clauses; JSON output keys each value by the fact's real name so all requested facts appear per host.
 - **Match value / `matchValue()`**: the value to match comes from `-m/--match` or, if that is empty, an optional positional argument. The positional fallback exists because pflag does not attach a space-separated value to a string flag grouped with a bool flag, so in `-pm k8s` the `k8s` arrives as a positional. `-m` still wins when both are given.
 - **`queryPuppetDB(url, query)`**: takes the URL as a parameter — never reads globals.
 - **`processResults()`**: iterates facts, returns sorted `"certname value"` strings. JSON string values are unquoted; other JSON types rendered as compact JSON.
@@ -138,5 +140,5 @@ mode (default, `-1`, `-2`, `-C`, `-j`, `-A`, `-a`). PuppetDB is stubbed with
 
 - `-1`, `-2`, `-C`, and `-A` all require `-R` or `-F`; the tool exits with an error otherwise.
 - `-C` (count) with stdin reads all lines as pre-fetched `"node value"` output for counting — it does **not** query PuppetDB per line.
-- JSON output (`-j`) builds `{ hostname: { factname: value } }` where the fact key is the `-F` value, the `role_fact` config value (if `-R`), or `"value"` as fallback.
+- JSON output (`-j`) builds `{ hostname: { factname: value } }` keyed by each result's actual fact name (so `-F ipaddress,enc_role` yields both per host); it falls back to the `-F` value, the `role_fact` config value (if `-R`), or `"value"` only when a result carries no name.
 - `config init` fails if the config file already exists (will not overwrite).