Reject unknown config keys

tests/integration.rs

@@ -578,6 +578,24 @@ fn config_invalid_toml_errors() {
     );
 }
 
+#[test]
+fn config_unknown_key_errors() {
+    let dir = TempDir::new().unwrap();
+    let cfg = write_config(&dir, "hardened = true\nbogus = \"nope\"\n");
+
+    let output = sandbox(&["--config", &cfg])
+        .args(["--", "true"])
+        .output()
+        .expect("failed to execute");
+
+    assert!(!output.status.success());
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    assert!(
+        stderr.contains("unknown config key"),
+        "expected unknown key error, got: {stderr}"
+    );
+}
+
 #[test]
 fn mask_hides_directory() {
     let dir = TempDir::new().unwrap();