fix: finalize run outcomes and metadata

[codeforester]

Summary

• Move run.json lifecycle authority into the core so every owned invocation is finalized with a canonical outcome, exit code, end time, and duration while optional history remains enrichment-only.
• Normalize successful returns, Click failures, aborts, interrupts, SystemExit, and unexpected exceptions through one failure-safe process boundary, including consistent handling for malformed custom Click exit codes.
• Make context construction transactional, preserve the primary command outcome across teardown failures, retain tracebacks in diagnostic logs, and add the public ConfigurationError contract for messages that are safe to show as usage errors.
• Document lifecycle ownership, outcome semantics, diagnostic behavior, rollback boundaries, and the consumer-profile migration.

Issue

Closes #52

Part of #50.

Validation

• .venv/bin/python -m pytest — 163 passed, 19 subtests passed
• .venv/bin/python -m compileall -q lib/python tests
• ./tests/validate.sh
• .venv/bin/python -m build --sdist --wheel --outdir <temporary-directory>
• .venv/bin/python scripts/validate_package_artifact.py <temporary-directory>
• git diff --check

Notes

• Parser failures, help/version requests, inherited runtimes, dry runs, and log_to_file=False remain outside owned run-bundle persistence by design.
• Consumer profile callbacks that intentionally expose a user-correctable configuration message should now raise base_cli.ConfigurationError; arbitrary ValueError, RuntimeError, and OSError instances are treated as private unexpected failures.
• Metadata writes remain best-effort and are not yet documented as atomic; atomic replacement is a separate hardening step in the roadmap.

Checklist

• Branch name follows <category>/<issue>-<YYYYMMDD>-<slug>, and its category prefix matches the issue's single standard category label.
• Pull request is scoped to one issue, unless a documented multi-issue exception applies.
• Pull request body explains what changed and how it was validated.
• Relevant project checks pass.
• Documentation is updated when behavior or user-facing commands change.
• CHANGELOG is updated for notable user-visible or release-worthy changes.
• Pull request includes Fixes #<issue> or Closes #<issue> when merge should close the issue.