fix(v1.100.2): SF-1 — nftban health spurious ERROR on released host

[itcmsgr]

Summary

Closes side finding SF-1 logged during the PR-24 7-day passive soak (Day 6, 2026-04-26 on lab4 / AuthorityNone host).

`nftban health` rendered a spurious `ERROR: Script failed` block on top of its own DOWN-status output when run on a released/no-tables host (validator legitimately exits 2 with no nftban tables present).

Root cause

`nftban_health_cmd_truth()` correctly captures the validator's exit code (2) and renders a clean DOWN table before returning. However, 4 call sites under `set -Eeuo pipefail` did not protect bare invocations from the ERR trap defined in `lib/strict.sh`:

Site	What
`cli/lib/nftban/cli/cmd_health.sh:140`	case branch `check|""|truth|axes`
`cli/lib/nftban/cli/cmd_health.sh:189`	case branch `json|--json`
`cli/sbin/nftban:917`	`main()` dispatch into `nftban_cmd_`
`cli/sbin/nftban:1261`	top-level `main "$@"` invocation

When the validator exited 2, each unprotected level fired the trap, printing `ERROR: Script failed` on top of the legitimate output — confusing operators and contradicting the in-table DOWN message.

Fix

Added the `cmd || return $?` (or `|| exit $?` at top level) idiom at all 4 sites.

The pattern was already documented and used inside `nftban_health_cmd_truth` itself (lines 413-421) for the same reason on the inner validator call:

R-2 (issue #470): capture validator exit code without triggering the
ERR trap under `set -Eeuo pipefail`. A bare `output=$(...)` assignment
propagates the command's non-zero exit to the trap, which kills the
health CLI at the exact moment an operator needs it.

Exit-code semantics preserved: a released host now exits 2 cleanly, matching the rendered `DOWN` status, with no spurious trap output.

Diff

3 files changed, 53 insertions(+), 5 deletions(-) — most of the diff is comments + CHANGELOG. The mechanical change is 4 small edits.

Verification

Local bash simulation reproduces the broken behaviour with the old pattern and confirms the new pattern propagates exit 2 cleanly:

```bash

Old: TRAP-FIRED printed on top of "DOWN table"

New: clean "DOWN table" then exit 2

```

Out of scope (locked per user 2026-04-27)

• Lifecycle execution surfaces untouched (`internal/installer/restore/`, `internal/installer/state/file.go`, `cmd/nftban-installer/uninstall_apply.go`, G3-UN- / G4-RESTORE-* CI gates).
• SF-2 (stale `FAILURE_REASON` retained in state file after `COMMITTED`) — separate cleanup, separate PR.
• Repo hygiene Phase A — separate (1.100.3+).
• Lifecycle completion lane (PR-25..PR-30) — remains explicitly OPEN.

Test plan

• CI `Build & Test` PASS
• CI `Build Docker Image` PASS
• CI `Build RPM` × 2 PASS
• CI `Build DEB` × 4 PASS
• CI `Test DEB install` × 4 PASS
• CI `Test RPM install` × 4 PASS
• CI `CLI Smoke Test` PASS
• CI `Runtime Truth` × 2 PASS
• CI `ShellCheck` (×2) + Shell Quality + Docs Quality PASS

🤖 Generated with Claude Code

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None