refactor(cli): throw CliError instead of calling process.exit

[Kamirus]

Problem

Direct process.exit() calls scattered across ~90 sites in the CLI silently terminate the process, bypassing any finally clauses in the call stack. This makes cleanup (lock files, temp dirs, subprocesses) unreliable and makes the code untestable in isolation.

Root cause

The CLI had no error-signalling contract — errors were communicated by calling process.exit() directly wherever an error was detected, rather than by propagating a value up the call stack.

Fix

Introduce a CliError class in cli/error.ts. The cliError() and cliAbort() helpers now throw a CliError instead of calling process.exit(). The only place process.exit() is now called is in handleCliError() — a single catch handler registered at the top-level entry point:

program.parseAsync().catch(handleCliError);

This means finally blocks throughout the call stack execute correctly when a CLI error is raised.

The three categories of remaining process.exit() calls (all with eslint-disable-next-line no-restricted-properties comments):

1. cli/error.ts — handleCliError, the single authorised exit point
2. SIGINT handlers in test.ts and install-mops-dep.ts — event callbacks where thrown errors cannot propagate
3. replica.ts — a detached stderr.on("data") handler for a long-running process, also cannot propagate

An ESLint no-restricted-properties rule on process.exit enforces this going forward.

Caveats

Catch blocks written to handle subprocess/runtime errors (e.g. execa failures) also needed updating — they previously were unreachable from cliError() since process.exit() terminated synchronously. Now that cliError() throws, these catch blocks must re-throw CliError instances so they are not wrapped in a new "Error while running X" message. All affected catch blocks in build.ts, check.ts, check-candid.ts, and lint.ts have been fixed.

Test plan

• All 63 existing tests pass, all 46 snapshots pass
• TypeScript type check passes (tsc --noEmit)
• ESLint clean on all changed files (pre-commit hooks pass)
• process.exit grep confirms no unguarded calls outside error.ts and legitimate event handlers