Use flags for acl runner edits, not signs

Use flags for acl runner edits, not signs

The first cut of `acl runners` took `+name` to add and `none` to clear. That is a
local dialect, and the project's flag parser exists to prevent exactly that: git
edits a list with flags (`config --add`, `config --unset-all`, `remote set-url
--add`) or with a subcommand (`sparse-checkout add`), never with a sigil. The `+`
appeared because `-name` collides with short options — which is a reason to use
flags, not a reason to invent syntax.

  vole acl runners <repo>                     # list
  vole acl runners <repo> <name>...           # replace, like `acl protect`
  vole acl runners --add <repo> <name>...     # add
  vole acl runners --remove <repo> <name>...  # remove
  vole acl runners --clear <repo>             # back to admins only

Two edits at once is refused rather than applied in sequence, and `--remove` fails
when the account is not on the list — `git config --unset` behaves the same way, and
a revocation that never happened should not look like one that did. The push refusal
that quotes the command now quotes this form.

Checked by hand against a throwaway instance as well as in tests, since the point of
the change is what the terminal says:

  $ vole acl runners demo
  runners: none named; only admins may report CI results for demo
    admin        01M5N98MV0GKB48CAFBGGTMMJF   keenan
  $ vole acl runners --add demo wilbur
  runner 01M5N98MVK8Q3S5S6D0DQJ8QG2   wilbur
  (admins may also report CI results)
  $ vole acl runners --add --clear demo wilbur
  vole: use one of --add, --remove or --clear    (exit 129)
  $ vole acl runners --remove demo keenan
  vole: keenan is not a runner for demo          (exit 1)

scripts/ci.sh green; TestACLRunnersEditsTheList now covers --add (including a repeat
that must not duplicate), replacement, --remove of an absent account, --clear, and the
two-edits-at-once refusal.