lint-once: bound the docker file flag to its own invocation

edgesOf used a single test/exec for docker build, so a line with two
builds produced one edge and the file flag was searched across the whole
line. Follow every occurrence with matchAll and slice each one to the
next shell separator before looking for its flag.

Also correct the README's claim that script/fmt-check is the one
formatting path left on the host.

README.md

@@ -127,10 +127,12 @@ in each. `test/packaging/lint-once.test.ts` asserts that count by walking the
 invocation graph, so a second pass cannot creep back in unnoticed.
 
 `script/fmt-check` remains as a standalone entrypoint for asking the formatting
-question on its own, without docker and without the rest of lint. It is the one
-formatting path that still runs on the host, and nothing reaches it: neither
-`script/check` nor `script/precommit` calls it, so it never contributes to their
-verdicts. Its own verdict cannot drift from the container's: prettier is pinned
+question on its own, without docker and without the rest of lint. It is not the
+last formatting path on the host — `script/fmt` writes with the host prettier,
+and `package.json` exposes `fmt` and `fmt-check` as direct prettier calls — it is
+the one of them that the check graph could plausibly have reached, and nothing
+reaches it: neither `script/check` nor `script/precommit` calls it, so it never
+contributes to their verdicts. Its own verdict cannot drift from the container's: prettier is pinned
 to an exact version, installed from `yarn.lock` under `--frozen-lockfile` in
 both places, and reads `.gitignore` as its default ignore file — which is why
 `.dockerignore` deliberately keeps `.gitignore` in the build context.