fix(observability-proxy): refuse positional arguments

The flag parser stops at the first argument that is not a flag, so
a stray word in the container args made every flag after it fall back
to its default without an error, the root tenant included.

Assisted-by: LLM
Signed-off-by: ZverGuy <maximbel2003@gmail.com>

cmd/observability-proxy/main.go

@@ -90,6 +90,11 @@ func parseFlags(args []string) (options, error) {
 	if err := fs.Parse(args); err != nil {
 		return o, err
 	}
+	// Parsing stops at the first non-flag, so every flag after it would
+	// be dropped silently.
+	if fs.NArg() > 0 {
+		return o, fmt.Errorf("unexpected argument %q", fs.Arg(0))
+	}
 	switch {
 	case o.rootTenant == "":
 		return o, errors.New("--root-tenant must not be empty")

cmd/observability-proxy/main_test.go

@@ -70,6 +70,7 @@ func TestParseFlagsInvalid(t *testing.T) {
 		{"--max-tails-per-user=-1"},
 		{"--max-tails=-1"},
 		{"--unknown"},
+		{"unexpected", "--root-tenant=tenant-x"},
 	} {
 		if _, err := parseFlags(args); err == nil {
 			t.Errorf("parseFlags(%v) accepted", args)