Actually, this is close but too far. What I meant was to put back the use of the <%= @java_args || @default_java_args -%> bits specific to the CLI tools, as opposed to JAVA_ARGS. So:

    ${JAVA_BIN} <%= @java_args || @default_java_args -%> -jar ${INSTALL_DIR}/puppetdb.jar anonymize "$@"