Fail closed when default validate reports FAIL

[jmjava]

Summary

• Default docgen validate (no --pre-push) now exits 1 when any check failed (not report.passed), after still printing the report. Callers can no longer treat a printed FAIL as success.
• --pre-push is unchanged: missing recordings stay a soft WARN and the command still exits 0 on that fixture.
• Proving test test_cli_validate_default_fail_exits_1 Click-invokes docgen validate on a missing-recording fixture. It fails on current main (exit 0 + FAIL in the report) and passes after this change.

Rebased the local-only leftover branch cursor/validate-default-exit-1 onto origin/main (d78a755, after #150/#152). Did not start leftover #150 factory-loop hunt. No clock/compile/_TimedScene changes; baseline.json not bumped.

Test plan

• test_cli_validate_default_fail_exits_1 against origin/main cli.py — failed (assert 0 == 1, report printed FAIL)
• Same test after the fix — passed
• pytest tests/test_cli_env.py (16 passed), including --pre-push missing-recording still exit 0
• ruff check src/docgen/cli.py tests/test_cli_env.py
• CI lint / unit / benchmark jobs on this PR

Made with Cursor