refactor(scripts): replace process.exit() with ExitError + runMain handler (#739) (#740)

Part 1 of 2 of the n/no-process-exit cleanup (umbrella #738): convert every
process.exit() call in standalone scripts/** CLIs to the rule-compliant pattern.

- New shared helper scripts/lib/cli-exit.cjs: ExitError(code,message) + runMain()
  which translates a thrown ExitError / returned number into process.exitCode
  (never process.exit()), flushing output and still firing process.on('exit').
- main()-based entrypoints: throw new ExitError(code) for errors, return <code>
  for verdicts; invoked via runMain(main). Child exit codes preserved via return.
- top-level-only scripts: imperative body extracted into main() so mid-flow
  aborts (throw ExitError) actually halt; pure consts/helpers stay at module scope.
- diff-touches-shipped-paths.cjs: stdin event handling restructured to an async
  read so the whole flow runs under runMain; uncaughtException/unhandledRejection
  nets replaced by an in-band catch that preserves EXIT_ERROR=2.

Exit codes verified unchanged for every converted script (success/error/help and
the 0/1/2 semantic codes in diff-touches). Rule stays warn here; flipped to error
in part 2 (#738) once gsd-core/bin/** is also clean.

Refs #739

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

scripts/ci-rebase-check.cjs

@@ -13,6 +13,8 @@
 
 const { execFileSync } = require('child_process');
 
+const { ExitError, runMain } = require('./lib/cli-exit.cjs');
+
 function run(cmd, args, opts) {
   try {
     execFileSync(cmd, args, { stdio: 'inherit', ...opts });
@@ -26,8 +28,7 @@ function runOrThrow(cmd, args, label) {
   try {
     execFileSync(cmd, args, { stdio: 'inherit' });
   } catch (e) {
-    process.stderr.write(`::error::${label} failed\n`);
-    process.exit(1);
+    throw new ExitError(1, `::error::${label} failed`);
   }
 }
 
@@ -35,48 +36,51 @@ const token = process.env.GITHUB_TOKEN || '';
 const baseBranch = process.env.GITHUB_BASE_REF || 'main';
 const repo = process.env.GITHUB_REPOSITORY || '';
 
-// Configure git identity (needed for merge commit).
-runOrThrow('git', ['config', 'user.email', 'ci@gsd-redux'], 'git config user.email');
-runOrThrow('git', ['config', 'user.name', 'CI Rebase Check'], 'git config user.name');
+function main() {
+  // Configure git identity (needed for merge commit).
+  runOrThrow('git', ['config', 'user.email', 'ci@gsd-redux'], 'git config user.email');
+  runOrThrow('git', ['config', 'user.name', 'CI Rebase Check'], 'git config user.name');
 
-// Set authenticated remote URL.
-if (token && repo) {
-  runOrThrow(
-    'git',
-    ['remote', 'set-url', 'origin', `https://x-access-token:${token}@github.com/${repo}.git`],
-    'git remote set-url'
-  );
-}
-
-// Fetch base branch with retry.
-for (let attempt = 1; attempt <= 3; attempt++) {
-  const result = run('git', ['fetch', 'origin', baseBranch]);
-  if (result) {
-    break;
+  // Set authenticated remote URL.
+  if (token && repo) {
+    runOrThrow(
+      'git',
+      ['remote', 'set-url', 'origin', `https://x-access-token:${token}@github.com/${repo}.git`],
+      'git remote set-url'
+    );
   }
-  if (attempt === 3) {
-    process.stderr.write(`::error::git fetch origin ${baseBranch} failed after 3 attempts.\n`);
-    process.exit(1);
+
+  // Fetch base branch with retry.
+  for (let attempt = 1; attempt <= 3; attempt++) {
+    const result = run('git', ['fetch', 'origin', baseBranch]);
+    if (result) {
+      break;
+    }
+    if (attempt === 3) {
+      throw new ExitError(1, `::error::git fetch origin ${baseBranch} failed after 3 attempts.`);
+    }
+    // Wait before retry: attempt * 4 seconds.
+    const waitMs = attempt * 4000;
+    const deadline = Date.now() + waitMs;
+    while (Date.now() < deadline) { /* busy wait, acceptable in CI */ }
+  }
+
+  // Attempt merge.
+  try {
+    execFileSync('git', ['merge', '--no-edit', '--no-ff', `origin/${baseBranch}`], { stdio: 'inherit' });
+  } catch (e) {
+    process.stderr.write(
+      `::error::This PR cannot cleanly merge origin/${baseBranch}. Rebase your branch onto current ${baseBranch} and push again.\n`
+    );
+    process.stderr.write('::error::Conflicting files:\n');
+    try {
+      execFileSync('git', ['diff', '--name-only', '--diff-filter=U'], { stdio: 'inherit' });
+    } catch (_) { /* ignore */ }
+    try {
+      execFileSync('git', ['merge', '--abort'], { stdio: 'inherit' });
+    } catch (_) { /* ignore */ }
+    throw new ExitError(1);
   }
-  // Wait before retry: attempt * 4 seconds.
-  const waitMs = attempt * 4000;
-  const deadline = Date.now() + waitMs;
-  while (Date.now() < deadline) { /* busy wait, acceptable in CI */ }
 }
 
-// Attempt merge.
-try {
-  execFileSync('git', ['merge', '--no-edit', '--no-ff', `origin/${baseBranch}`], { stdio: 'inherit' });
-} catch (e) {
-  process.stderr.write(
-    `::error::This PR cannot cleanly merge origin/${baseBranch}. Rebase your branch onto current ${baseBranch} and push again.\n`
-  );
-  process.stderr.write('::error::Conflicting files:\n');
-  try {
-    execFileSync('git', ['diff', '--name-only', '--diff-filter=U'], { stdio: 'inherit' });
-  } catch (_) { /* ignore */ }
-  try {
-    execFileSync('git', ['merge', '--abort'], { stdio: 'inherit' });
-  } catch (_) { /* ignore */ }
-  process.exit(1);
-}
+runMain(main);