bug(runtime): Grep reports "no matches" for any pattern starting with `-`

[udsy19]

What happened

The sandboxed filesystem worker appends the Grep pattern as a bare positional, so
ripgrep parses a pattern beginning with - as flags:

packages/runtime/src/filesystem-worker/operations.ts:416

args.push(operation.pattern, path);

-webkit-box makes rg exit 1, and packages/runtime/src/filesystem-worker/operations.ts:425
maps exit 1 to { kind: 'grep', matches: [] }. The model is told the string is
absent from a file that contains it — no error, no diagnostic. --flag instead
exits 2 and surfaces "Grep failed while searching files."

The host-local sibling already gets this right at
packages/runtime/src/workspace-executor.ts:455 (args.push('--', input.pattern, input.path)),
pinned by packages/runtime/src/__tests__/workspace-executor.test.ts:259. That
separator arrived in #2961, which edited this worker's grep case in the same
commit and left its argv unchanged.

The worker is the default path on macOS/Linux for every boundary except bypass
and external (packages/runtime/src/filesystem-executor.ts:193-208).

How to reproduce

Ask the agent to Grep a CSS file for -webkit-box. It answers "no matches".

Directly, against ripgrep 15.1.0:

$ printf 'a { display: -webkit-box; }\n' > style.css
$ rg -n --no-heading --max-count=5 -webkit-box style.css   ; echo $?
1
$ rg -n --no-heading --max-count=5 -- -webkit-box style.css ; echo $?
1:a { display: -webkit-box; }
0

Environment

macOS 26.5.1 (25F80), Node v26.7.0, ripgrep 15.1.0, main at 958176a.

[yunaremaia]

Taking this one - the diagnosis is spot-on and the workspace-executor sibling gives us a pinned contract to mirror. Fix + regression test in #3735.