… wrapper

PR boxlite-ai#622 review follow-up: address the aesthetic drift introduced by the
RAII fix (per-branch .map(|_| 0) noise and the ExitCode::from(... as u8)
cast in main).

- Every command's `pub async fn execute` (and `auth::run`) now returns
  `anyhow::Result<i32>`. Unit-success commands `Ok(0)` at the end; run/exec
  pass through the box's mapped shell exit code unchanged. Dispatcher in
  `run_cli` no longer needs `.map(|_| 0)` adapters.
- `main` is back to `fn main()`. The tokio runtime is dropped explicitly
  before `process::exit(code)` so the BoxliteRuntime Drop chain
  (RuntimeImpl::Drop -> shutdown_sync) has already finished by then — the
  hazard called out in boxlite-ai#622 was `process::exit` *mid-command*, not in
  `main` after every stack frame has unwound.

Verified: cargo check, 118 CLI unit tests, clippy -D warnings, fmt:check,
and the focused leak repro (test_run_rm_non_zero_exit_does_not_leak_shim,
ok 8.57s) all green.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Walk back the scope-creep portion of 69df038. The shim-leak RAII fix only
needs run.rs / exec.rs / main.rs — making the 15 unit-success commands
also return Result<i32> was purely dispatcher cosmetics, and it had a
type-honesty cost: a command like `boxlite cp` that has no exit-code
concept ended up advertising one (always 0).

This commit:

- Restores `anyhow::Result<()>` + `Ok(())` on auth/cp/create/images/info/
  inspect/list/logs/pull/restart/rm/serve/start/stats/stop.
- Puts the 15 `.map(|_| 0)` adapters back in `run_cli`'s dispatcher,
  collocated so the asymmetry is visible at one site (`run`/`exec` real;
  others adapted).
- Keeps main.rs's `fn main() { ... drop(rt); process::exit(code); }`
  simplification — that part isn't scope creep, it's the RAII fix.

cargo check, 118 CLI unit tests, clippy -D warnings, fmt:check,
test_run_rm_non_zero_exit_does_not_leak_shim (ok 8.22s) all green.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…rn paths

The focused boxlite-ai#622 reproducer (test_run_rm_non_zero_exit_does_not_leak_shim)
only exercises the std::process::exit branch that actually leaked. Add
two companion tests that pin the same RAII invariant onto the two other
CLI-reachable early-return points in BoxRunner::run:

- test_run_image_pull_failure_does_not_leak_shim (branch ②) — create_box?
  fails on a non-existent image; no shim ever spawns, but partial-VM
  state must drop cleanly.
- test_run_exec_setup_failure_does_not_leak_shim (branch ③) — litebox.exec?
  fails (invoking a directory) after the box is fully running; Drop has
  to reap the live shim.

Both pass under today's RAII fix (4.4 s each in parallel). These branches
are not affected by the original boxlite-ai#622 bug (they use `?` rather than
process::exit, so Drop always ran) — the value is forward-looking: if
anyone introduces a Drop-bypass shortcut on these paths later, the tests
fail.

The remaining two early-exits in BoxRunner::run — streamer.start?
(signal-handler init, effectively unreachable in normal CLI invocation)
and a panic mid-`run()` — are left to Rust's stack-unwinding guarantee
plus PerTestBoxHome::Drop's implicit guard, documented inline so the
choice is visible. No mock-injection tests for those.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>