ci(make): reserve exit 69 for "could not run" (D-26)

Environment guards now exit 69 rather than 1, so a caller can tell a suite
that could not start from one that ran and failed. The first toj test sweep
reported "3 repositories failed" and none of the three had executed a test —
two could not find go, one had no venv. That points the reader at the tests
when the fault is in the environment.

Only the environment guards change. A gitleaks finding, a failed test run and
a vulncheck hit still exit 1, because those did run and did fail.

Co-Authored-By: Claude <noreply@anthropic.com>

Makefile

@@ -28,10 +28,10 @@ run: ## Dev server on :8778 with reload (8089 is the container, not this)
 
 .PHONY: test
 test: ## Run the test suite
-	@test -x $(VENV)/bin/python || { echo "FAIL — no venv; run: make setup"; exit 1; }
+	@test -x $(VENV)/bin/python || { echo "FAIL — no venv; run: make setup"; exit 69; }
 	$(VENV)/bin/python -m pytest tests/
 
 .PHONY: lint
 lint: ## ruff check over the sources
-	@test -x $(VENV)/bin/ruff || { echo "FAIL — ruff not installed; run: make setup"; exit 1; }
+	@test -x $(VENV)/bin/ruff || { echo "FAIL — ruff not installed; run: make setup"; exit 69; }
 	$(VENV)/bin/ruff check src tests