cli: return gate exit code instead of exiting inside run_check

[greygoody]

What to build

When the reason-specific exit-code slice is ready, make the gate handler return the gate exit code to main instead of calling std::process::exit inside run_check. Keep current behavior unchanged unless that later slice intentionally changes exit-code semantics.

Acceptance criteria

• run_check or its replacement returns a result that includes the gate exit code instead of exiting internally.
• main owns the final process-exit decision for the gate command.
• Current 0, 2, and 3 behavior is preserved until the reason-specific exit-code slice changes it intentionally.
• check and ok still share the same command path.
• cargo fmt --all -- --check passes.
• cargo test --workspace passes.

Blocked by

Reason-specific exit-code slice, unless needed earlier.