Keep command output to the README's stdout and stderr rules (closes #224)

The startup banner moves from stdout to stderr, so a `completion`
script, a `config get` value and the hidden `__complete` command print
only their own output. `--quiet`, `--cron` and `--json` still suppress
it.

A failing `remote info`, `prune` or `snapshot remove` under `--json`
now reports its error on stderr. Their reporters returned early under
`--json`, so the failure reached neither stream.

`snapshot verify --quiet` writes no report. A failure is still
returned and printed on stderr, with the same exit status.

Judgement call: the banner's stream, posted on the issue for the owner.

Model: opus-5-5

internal/cli/entry_banner_test.go

@@ -36,8 +36,8 @@ const (
 	// strips it before scanning, so it has to be present.
 	programName = "vaultik"
 
-	// someSnapshotID is any snapshot identifier: these tests never run
-	// the command, so it only has to occupy the positional argument.
+	// someSnapshotID only fills the positional argument; no test needs
+	// the snapshot to exist.
 	someSnapshotID = "host_2026-01-01T00:00:00Z"
 )