PROD-2310: sync exits non-zero on failures and precondition aborts

[5PK]

Root cause

agility sync exited with code 0 even when work failed, so CI (which keys on exit code) could not detect problems. Two defects combined:

1. The success signal was ignored. The push/sync command handler in index.ts called push.pushInstances() but discarded the returned { success } entirely (unlike the workflows command, which does check it). So even a computed success === false never affected the exit code.
2. success ignored auto-publish errors. In push.ts, success was computed before the auto-publish step ran, so auto-publish failures (e.g. 34 publish errors) never fed into it.
3. Precondition aborts returned silently or relied on unhandled-rejection behavior. A failed validateCommand (e.g. a requested locale missing on the target) just returned (exit 0); a model-validation hard-stop threw out of pushInstances with no explicit exit handling.

What now feeds the failure signal

• Item failures (totalFailed / totalSyncFailures) — already computed as syncSuccess, now actually honored by the entry point.
• Auto-publish errors — folded into the returned success via the new exported helper hasBlockingAutoPublishErrors. Real publish failures (type: "publish") and fatal auto-publish crashes (type: "fatal") fail the exit code.
• Precondition abort — missing locale / failed validation — validateCommand returning false now exits 1.
• Precondition abort — model-validation hard-stop — the thrown error is caught in the sync handler and exits 1.

Left for follow-up

Auto-publish mapping/refresh errors are post-publish bookkeeping that PROD-2311 may reclassify, so they are intentionally NOT treated as hard failures here (documented in-code). If PROD-2311 confirms they are real failures, extend hasBlockingAutoPublishErrors.

Notes

• Preserves the "only exit at the entry point" contract: pushInstances still returns a result; the handler decides the exit. No process.exit() added deep in push logic. Existing preflight process.exitCode behavior is unchanged.
• npm run type-check passes. Added focused unit tests for hasBlockingAutoPublishErrors (suite not run per task scope).

🤖 Generated with Claude Code