fix(std): pass the tar member name after --

[haribo]

Summary

archive.extract-member passed "$member" to tar with no --, on both the observe
(archive.shellf:62) and the apply (:78). A member named -rf.txt is read as options, so
the observe saw a hash mismatch and the apply failed — for ever, since neither run can
converge. The name comes from whoever built the archive, not from the plan.

The two other tar calls in the file take no member (tar xzf … -C, tar tzf) and are
unaffected — checked, not assumed.

Test plan

test/e2e/plans/adverse-archive.extract-member-dash.shellf, verified red on a real container
before the fix:

RED   archive.extract-member(member=-rf.txt, …)
        ! tar: You may not specify more than one '-Acdtrux', '--delete' or '--test-label' option
green archive.extract-member(member=-rf.txt, …)   → out.txt holds `dashed`

The four existing archive cases re-run green beside it (extract-member, extract,
extract-contents, extract-emptied).

Its own file rather than an extension of adverse-archive.extract-member.shellf: one plan per
case (adverse-cases.md), and that plan already carries the space/quote/& argument. The
fixture needs no --transform — tar czf … -C src -- -rf.txt stores the bare name, which
tar czf … . never produces, which is exactly why this is reachable and rare.

go test ./..., test/changelog-rule.sh, test/e2e/def-coverage.sh green.

Closes #639