fix(tunnel): parse flags after the <sandbox> positional

[pratikbin]

Problem

createos sandbox tunnel my-box --remote 8000 fails with --remote <port> is required — even though that exact flags-after-positional form is shown in the command's own --help examples.

Root cause: urfave/cli v2 stops flag parsing at the first positional argument. The edit command already documents and works around this with a hand-rolled parseEditArgs; tunnel never got the equivalent, so --remote/--local/--bind placed after <sandbox> are silently dropped.

This also breaks the createos-sandbox Claude plugin, whose cos driver invokes tunnel in exactly this order — every /createos-sandbox:tunnel died on it.

Fix

Add parseTunnelArgs, mirroring parseEditArgs: seed from c.* (keeps flags placed before the positional working), then re-scan the raw args so a later --remote/--local/--bind in any position wins. Handles both --flag value and --flag=value.

Verification

Built a linux/amd64 binary and ran against a live sandbox — all three now succeed:

invocation	before	after
tunnel <id> --remote 9090 --local 9091 (was broken)	ERROR --remote required	✅ Forwarding
tunnel <id> --remote=9093 --local=9094	ERROR	✅ Forwarding
tunnel --remote 9095 --local 9096 <id> (flags-first)	✅	✅

go build / go vet / gofmt / golangci-lint clean.