Extract flags/flagSeparator into a new flags.nix module, separate from
command.nix. Flags now support per-flag ordering via { value, order }
submodules with coercion so the shorthand (flags."--foo" = "bar") still
works. Reading config.flags returns clean values (apply strips order).
An internal _orderedFlags option preserves order info, and args are
generated using mkOrder per-flag so listOf merge handles positioning.

Instead of hardcoding "$@" in the wrapper template, inject it into the
args list at order 1001 (just after the default flag order of 1000).
This makes passthrough argument positioning controllable via the
ordering system — flags with order > 1001 appear after "$@".

The wrapper module passes a custom wrapper function to wrapPackage
that omits the hardcoded "$@" since it's now part of args.

Add flags-order check verifying: --early (500) < --greeting (1000) <
"$@" (1001) < --late (1500).

The " " default was confusing: it didn't join with a space but produced
separate argv entries. Change the default to null which clearly means
"separate argv entries", while " " now actually joins with a space
(single arg). This makes the semantics consistent with "=".

null  → ["--flag" "value"]  (separate args, default)
"="   → ["--flag=value"]    (joined)
" "   → ["--flag value"]    (joined with space)

Instead of hardcoding "$@" in the wrapper template, include it in the
default args list. The template no longer appends "$@" on its own.

This means passing explicit args to wrapPackage gives full control
over whether "$@" is included. The default args (from flags) still
append "$@" for backward compatibility.

Removes the custom wrapper function override from wrapper.nix since
wrapPackage's template no longer conflicts with the module's "$@"
injection.

Add CHANGELOG documenting breaking changes.