feat: add stable agent error contract

[chaim0m]

Summary

• map HTTP and CLI failures to a finite, documented exit-code contract
• emit exactly one structured JSON error on stderr in agent mode
• suppress Cobra usage/error chatter when a structured agent error is returned
• preserve retry, request ID, HTTP status, and authentication guidance when available

Part of #12. API idempotency keys remain a server-side follow-up.

Test methods

Automated validation run on this branch:

go test ./...
go vet ./...

Manual validation:

go build -o /tmp/dci-pr32 .
DCI_AGENT_MODE=1 DCI_API_KEY=invalid /tmp/dci-pr32 list-budgets --output json
echo $?
DCI_AGENT_MODE=1 /tmp/dci-pr32 not-a-command
echo $?

The first command should produce one JSON error on stderr and a specific non-zero exit code. The unknown command should also produce one structured error without Cobra usage text being mixed into it.

Could this break things?

Risk: medium. This changes the CLI-wide error and exit-code behavior, especially in agent mode. Scripts that currently assume every failure exits with 1, or parse duplicate human-readable stderr, may need to adopt the documented codes and JSON envelope. It does not change API requests or successful command output.

Example contract:

{"error":{"code":"AUTHENTICATION_FAILED","message":"...","hint":"Run: dci login","retryable":false,"http_status":401}}