fix: address v0.5.0 review findings

- Add --to/--test-cmd mutual exclusivity guard in rollback script
- Convert all jq string interpolation to --arg (cmd_extract, cmd_inject, cmd_forget)
- Fix CRITICAL/WARNING grep to match table rows only (not prose)
- Add thorough+cycle-1 guard to fast-path bash snippet in check-phase
- Clarify prev_run_id selection comment (tail -1 = most recent non-current)

lib/archeflow-rollback.sh

@@ -29,6 +29,12 @@ while [[ $# -gt 0 ]]; do
   esac
 done
 
+# Mutual exclusivity check
+if [[ -n "$TARGET_PHASE" && -n "$TEST_CMD" ]]; then
+  echo "ERROR: --to and --test-cmd are mutually exclusive." >&2
+  exit 2
+fi
+
 # --- Phase rollback mode ---
 if [[ -n "$TARGET_PHASE" ]]; then
   # Validate phase name