fix(cli): the headless commands were silent whether they worked or not

improvise-q914 and improvise-j6x8 are one bug seen twice, and the second
measured it: `run_headless_commands` applied effects and never read
`app.view_state.status_msg`, setting `exit_code` only for parse errors. A
successful command and a refused one therefore produced byte-identical
output — nothing — and exit 0 for both. `improvise script` is the same
function, so it shared the hole exactly.

Three decisions, argued in `context/code/cli.md`:

**Everything to stderr.** The tempting split — stdout for a report, stderr
for a refusal — cannot be built honestly, because `status_msg` is a bare
`String` with no severity and both candidate classifiers are disproved by
code already in the tree. "A refusal aborted" is false: `AddItem` writes its
`Err` to the status and does not abort, and that is q914's own example. "A
refusal is anything that spoke" is false too: `cmd/fit.rs` reports the seed
that reproduces a fit on **success**. Guessing between them is the adjacent
check design-principles §7 names.

**Exit 1 on a parse error or an aborted batch, and no further.** Both are
real flags. A refusal that only writes a status is now printed but still
exits 0, because nothing can classify it; the README says so plainly rather
than over-promising, and closing it needs a severity on `ViewState`, which
is a wire change reaching the browser.

**No quiet flag.** Silence is never the default and `2>/dev/null` already
exists.

Also: a run that changed nothing no longer rewrites the document. Saving
unconditionally normalised it — `1e20` to its twenty digits — which turns a
hand-edited fixture into a silent no-op. The gate accumulates
`model_state.dirty` per command rather than reading it once at the end,
because `effect::Save` clears the flag and `[add-item, w elsewhere]` would
otherwise drop the edit.

And the three clap doc strings advertised JSON, which the parser refuses.

`tests/headless_cli.rs` pins all of it at the process boundary, where an
exit code and a stream exist. Six of its twelve tests fail at bf83294. The
rival worth injecting — print on the happy path, stay silent on the
refusal — fails five of them.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FC2jVn8Au7E9JPkw6bwXXH

README.md

@@ -190,6 +190,30 @@ improvise cmd 'add-cat Region' 'add-item Region East' -f model.improv
 improvise script setup.txt -f model.improv
 ```
 
+The language is the `:` command line, exactly as typed in the TUI — not JSON.
+Arguments split on whitespace, so anything containing a space is quoted:
+
+```sh
+improvise cmd 'formula Product "Total = Widget + Gadget"' -f model.improv
+```
+
+### What the headless commands promise
+
+- **Everything a command reports goes to stderr**, as it would appear on the
+  TUI's status line, and stdout is left empty. A run that had nothing to report
+  prints nothing, so `2>/dev/null` is the whole suppression story and there is
+  no quiet flag.
+- **Exit 1** means a line did not parse, or an effect aborted the rest of its
+  batch — a failed `:w`, say. **Exit 0 means neither of those happened**, and
+  it does *not* promise every command did what it was asked: a refusal that
+  only writes a status message (`add-item` naming a category that does not
+  exist) is printed but still exits 0, because a status message carries no
+  severity for the exit code to read. Check stderr as well as `$?` when it
+  matters.
+- **A run that changed nothing does not rewrite the document.** Writing it back
+  regardless silently normalises it — `1e20` becomes its twenty digits — which
+  turns a hand-edited fixture into a no-op on the next run.
+
 ## In the browser
 
 The browser page is at **<https://fiddlerwoaroof.github.io/improvise/app/>**,