Accept match value positionally so -pm <value> works

pflag does not attach a space-separated value to a string flag that is grouped
with a bool flag, so `node-lookup -R -pm k8s` parsed -p and left `k8s` as a
stray positional, failing with "unknown command k8s". Only `-pm=k8s` or the
un-grouped `-p -m k8s` worked, which is surprising.

- Allow one positional argument (cobra.MaximumNArgs(1)) and fall back to it for
  the match value when -m is empty (matchValue()), so -pm/-im/-ipm <value> and
  a bare `-p <value>` all work. -m still wins when both are given.
- Add matchValue unit tests.
- Document the positional value and the pflag grouping quirk in AGENTS.md.

AGENTS.md

@@ -59,10 +59,11 @@ installed. To load ad-hoc in the current shell, e.g. zsh:
 ./node-lookup -R                          # show all nodes with role fact
 ./node-lookup -n <hostname>               # lookup a specific node
 ./node-lookup -F <fact_name>              # filter by fact name
-./node-lookup -m <value>                  # exact value match (-m)
-./node-lookup -pm <value>                 # partial/regex match (-p -m combined)
-./node-lookup -im <value>                 # inverse exact match (-i -m combined)
-./node-lookup -ipm <value>                # inverse partial match (-i -p -m combined)
+./node-lookup -R -m <value>               # exact value match (-m)
+./node-lookup -R -pm <value>              # partial/regex match (-p -m combined)
+./node-lookup -R -im <value>              # inverse exact match (-i -m combined)
+./node-lookup -R -ipm <value>             # inverse partial match (-i -p -m combined)
+./node-lookup -R -p <value>               # value may also be given positionally
 ./node-lookup -R -1                       # node names only
 ./node-lookup -R -2                       # values only
 ./node-lookup -R -C                       # count occurrences
@@ -110,6 +111,7 @@ Show the active configuration (after all overrides applied):
 
 - **`loadConfig()`**: reads config file → applies env vars → returns `config` struct. Called once at startup in `main()`.
 - **`buildQuery()`**: returns a PuppetDB PQL-compatible JSON array string. Uses `roleFact` from config (not hardcoded). Match modifiers: `-p` (partial/regex, uses `~` op), `-i` (inverse, wraps with `not`), composable.
+- **Match value / `matchValue()`**: the value to match comes from `-m/--match` or, if that is empty, an optional positional argument. The positional fallback exists because pflag does not attach a space-separated value to a string flag grouped with a bool flag, so in `-pm k8s` the `k8s` arrives as a positional. `-m` still wins when both are given.
 - **`queryPuppetDB(url, query)`**: takes the URL as a parameter — never reads globals.
 - **`processResults()`**: iterates facts, returns sorted `"certname value"` strings. JSON string values are unquoted; other JSON types rendered as compact JSON.
 - **Output modes**: JSON (`-j`), count (`-C`), Ansible YAML (`-A`), node-only (`-1`), value-only (`-2`), default (node + value).