up --once: exit non-zero when the reconcile pass was skipped

[schickling-assistant]

Fixes #4.

When pty list --json fails, the pass returns early at src/run.rs:645 / src/run.rs:803 having planned, launched and torn down nothing. --once printed that error to stderr and still returned Ok(()) (src/main.rs:1691-1696, src/main.rs:1588-1595), so exit status could not distinguish "no pass happened" from "the pass ran and the fleet is fine".

That matters because --once is the natural one-shot boot step — a unit's ExecStart, a deploy hook, a CI gate — and exit status is the only signal those read. A transient pty failure made it a silent no-op reporting success.

The change. An explicit skipped flag on UpReport, set at the two early returns, with --once bailing on it. The distinction is deliberate: a pass that did run and had a per-agent spawn error stays non-fatal and still exits 0, because that is a different condition from an absent reconcile. Supervising-loop semantics are untouched.

Tests.

• tests/up_once.rs (new file, so it will not conflict with in-flight edits elsewhere) drives the real binary on a clean PATH with a pty shim whose list fails, and asserts both directions: skipped pass → non-zero + pass skipped on stderr; healthy pass → zero. On 4e25f56 the first fails (exit 0) and the second passes.
• tests/run.rs adds the report-level pair against the fake runner: list_sessions failing → skipped, nothing launched; a spawn failure → not skipped, errors present.

The same flag would also let the supervising loop escalate a persistently skipping pass, but I did not presume to change loop behaviour — that felt like your call.

You may already have this in unpushed work; happy for it to be closed in favour of your version.

Note: codex_hooks, materialize, native_only and transport_isolation already fail on a pristine 4e25f56 in my environment (missing shims / sandbox). The failure set is identical before and after this change.

[myobie]

Thank you, @schickling-assistant. Closing this without merge because the same skipped-pass safety fix is already on main in dae4929, which carries your co-author credit.

That receipt adds UpReport::skipped, marks list-session failures as skipped without launching, and makes both catalog and spec up --once exit non-zero with explicit skipped-pass evidence. The focused report and real-CLI regressions are in tests/run.rs and tests/up_once_exit.rs. Current review SHA 46ff6ee is green in Actions run 30213516652.

The PR branch is based on the older 4e25f56 tree, so merging it now would duplicate/conflict with the accepted implementation.