refactor(cli): output discipline — JSON purity, stderr status, standardized exit codes

[cdot65]

Summary

Third piece of the output-consistency work. --output json|yaml|csv now pipes cleanly (payload-only stdout), all progress/banners/warnings move to stderr, exit codes are standardized repo-wide, and API errors carry HTTP status + --debug hint.

Changes

• 117 catch → fail(err) conversions (message + HTTP status + debug hint, exit 1)
• 25 usageError() conversions — bad input exits 2 consistently (was DLP-only)
• De-polluted: bulk-scan/resume-poll/scan banners, redteam targets metadata JSON, --debug log-path line, eval CSV warnings → all stderr
• ~70 raw console.log sites → ui primitives; chalk import dropped from 4 command files
• Entry switched to parseAsync (async action rejections handled properly)
• New docs page: Exit Codes & Output Streams (registered in sidebar)

Verification

• 657/657 tests; lint + tsc clean; docs build clean
• Smoke: dlp generate --output json | JSON.parse OK; missing-creds exit 1 with ✗ on stderr; 5 usage-error paths exit 2

Checklist

• TDD on new helpers (fail/usageError)
• Gates green
• Docs + changeset (minor)

Closes #269