cli: restrict ExitCodeError unwrap to the CLI's own type

main.go previously unwrapped *any* error implementing `ExitCode() int`
into the process exit status, which matched *exec.ExitError too. So
whenever a CLI command ran a subprocess (mkfs.ext4, debugfs, ssh to a
daemon preflight, etc.) and that subprocess failed, the CLI would
silently exit with the subprocess's code — no error message printed.
Surfaced while bringing up `banger internal make-bundle`: mkfs.ext4
was failing on an undersized ext4 and the user saw only `EXIT=1`.

Fix: export the type as `cli.ExitCodeError` and unwrap against the
concrete type in main.go. The `ExitCode()` method is gone — only the
explicit wrap at the `vm run` command-mode call site produces this
error now.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

cmd/banger/main.go

@@ -17,9 +17,9 @@ func main() {
 
 	cmd := cli.NewBangerCommand()
 	if err := cmd.ExecuteContext(ctx); err != nil {
-		var exitErr interface{ ExitCode() int }
+		var exitErr cli.ExitCodeError
 		if errors.As(err, &exitErr) {
-			os.Exit(exitErr.ExitCode())
+			os.Exit(exitErr.Code)
 		}
 		fmt.Fprintf(os.Stderr, "banger: %v\n", err)
 		os.Exit(1)