Stamp Docker image version from the host; flush profiles on error exit (closes #75)

Docker images reported commit unknown because the build ran git inside the container while .dockerignore excludes .git, and VERSION was never overridden. script/docker and script/cibuild now compute version, commit and date on the host and pass them as build args; the Dockerfile runs no git and falls back to dev and unknown, never empty, on a bare docker build.

Profiling a failing command gave a truncated or missing profile: Entry and each command goroutine called os.Exit(1), skipping the deferred profile writers in main. Entry now returns a status that main exits with after its defers run, and command goroutines report failure through one RunOperation helper, which also restores PID-lock release and graceful shutdown on failure.

model: claude-opus-4-8 (implementation, review); claude-fable-5-1 (merge)

Co-authored-by: clawbot <clawbot@noreply.example.org>

internal/cli/entry.go

@@ -1,6 +1,7 @@
 package cli
 
 import (
+	"errors"
 	"io"
 	"os"
 	"strings"
@@ -19,7 +20,11 @@ const shortCommitLen = 12
 // flag is present in os.Args — see bannerSuppressedInArgs), executes the
 // root cobra command, and routes any returned error through the
 // ui.Writer so the user sees a properly formatted "🛑 ERROR:" line.
-func Entry() {
+//
+// It returns the process exit code (0 on success, 1 on error) rather
+// than calling os.Exit, so that main's deferred profile writers run
+// before the process ends. See run in cmd/vaultik/main.go.
+func Entry() int {
 	emitStartupBanner(os.Args[1:], os.Stdout)
 
 	rootCmd := NewRootCommand()
@@ -27,9 +32,19 @@ func Entry() {
 
 	err := rootCmd.Execute()
 	if err != nil {
-		ReportErrorf("%s", err.Error())
-		os.Exit(1)
+		// An operation that ran inside the fx app has already reported
+		// its own failure (and suppressed it under --json); errReported
+		// says so. Printing it again here would double the error line.
+		// Every other error — bad arguments, a config that would not
+		// load — reaches Entry unreported, so it is shown here.
+		if !errors.Is(err, errReported) {
+			ReportErrorf("%s", err.Error())
+		}
+
+		return 1
 	}
+
+	return 0
 }
 
 // emitStartupBanner writes the startup banner to w unless args (the