Closes #294.

Combined-mode --format json writes two top-level JSON documents to stdout when the project is outside a Git repository: first a { "error": true, "message": "hotspot analysis requires a git repository", ... } blob, then the normal combined report. That breaks fallow --format json | jq . and any agent or CI parser that assumes a single document. The nixpkgs build of 2.65.0 hit this in five combined-mode integration tests whose temp fixtures live outside any Git checkout.

Where the second blob comes from

crates/cli/src/health/hotspots.rs::fetch_churn_data is called from inside the health pipeline. When is_git_repo(opts.root) returns false it does:

if !churn::is_git_repo(opts.root) {
    let _ = emit_error("hotspot analysis requires a git repository", 2, opts.output);
    return None;
}

emit_error with OutputFormat::Json println!s a structured error object to stdout regardless of who called it. The function then returns None, which the caller already handles gracefully ((Vec::new(), None) for hotspots — see crates/cli/src/health/mod.rs:520). Combined mode then continues, builds the combined report, and print_combined_json println!s it. Two documents on stdout, one well-formed parser per side.

Fix

Treat a missing Git repo as unavailable hotspot data rather than a hard error. The hotspot pipeline already silently degrades to an empty section when fetch_churn_data returns None, so dropping the JSON emission lets combined mode keep its single-document contract. A non-fatal note: hotspot analysis skipped — no git repository found at project root goes to stderr unless --quiet is set.

This also fixes standalone fallow health --hotspots --format json outside a Git repo: it now emits one well-formed health report with empty hotspots and exits 0, which lines up with the first acceptable resolution suggested in the issue ("treat missing Git history for hotspot analysis as unavailable data in the combined report").

The other emit_error paths in fetch_churn_data cover --since malformed input — those are user-error invariants and are not reachable from combined mode (build_health_opts hard-codes since: None), so they keep their existing exit-2 contract.

Test

Adds combined_json_outside_git_repo_emits_single_document to crates/cli/tests/exit_code_tests.rs. The test:

1. Creates a minimal TS project in a tempdir (/tmp/...), so is_git_repo walks up and returns false.
2. Strips inherited GIT_DIR / GIT_WORK_TREE and points GIT_CONFIG_GLOBAL / GIT_CONFIG_SYSTEM at /dev/null so a parent-process git env can't redirect rev-parse upward (this matches the isolation pattern already used by health_tests.rs::git).
3. Runs fallow --root <tempdir> --format json --quiet (combined mode).
4. Asserts stdout parses as exactly one serde_json::Value (the original failure mode failed to parse JSON: trailing characters at line 6 column 1 reproduces here without the fix).
5. Asserts the parsed envelope has schema_version and no top-level error key.

I confirmed the test fails on main and passes with the patch applied locally.

Verification

• cargo test -p fallow-extract -p fallow-cli --bin fallow — 1755 pass, 0 fail
• cargo test -p fallow-cli --test exit_code_tests — 16 pass, 0 fail (includes the new case)
• cargo test -p fallow-cli --test health_tests — 30 pass, 0 fail
• cargo test -p fallow-cli --lib — 1226 pass, 0 fail
• cargo test -p fallow-extract --lib — 1392 pass, 0 fail
• cargo clippy -p fallow-cli --bin fallow --tests — clean
• cargo fmt --check — clean