refactor(prover): separate outcome evaluation from rendering

[eviehoward]

Summary

Moves exit-code logic out of the renderers and into prove(), so outcome evaluation happens once in a single place rather than independently in each renderer.

Related Issue

Closes #2411

Changes

• render_compact and render_report return () instead of i32; all exit-code logic removed from both
• prove() computes exit code after rendering: i32::from(findings.iter().any(|f| !f.accepted))
• Call site in prove() drops unused policy_path/credentials_path args from render_compact
• Both renderer banners gate on active.is_empty() rather than path_count > 0, so terminal output and exit code agree for pathless unaccepted findings
• Four unit tests added covering: empty findings, all-accepted, unaccepted with paths, pathless unaccepted (the case the old renderers got wrong)

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated - not applicable, no infrastructure, sandbox, or policy changes

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated - not applicable, internal refactor, no behavioral or API change

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

This pull request has had no activity for 14 days and is now marked stale. It may be closed in 7 days if there is no further activity.

[eviehoward]

I'm still keeping an eye on this, AFAIK it's still mergeable- please let me know if anything needs changing or if a rebase is needed 🙂

[2000krysztof]

Thanks for addressing my concerns @eviehoward LGTM