Choose and implement the broken-stdout exit policy

## Validated scope and current-PR plan — 2026-09-11

This section records the QA review and the current decision to finalize existing PRs without opening new PRs. It supersedes the proposed routing/fix suggestions in the original report below; the original observations are retained. Central plan: #757.

### Disposition

Deferred from this existing-PR finalization pass. Keep the issue open; no new PR is requested now. This is not a resolution, a severity downgrade, or a waiver of release acceptance.

### Validation and corrections

Reproduced exit 101 with a large schema-valid mock response and a closed stdout reader. Related to [#767](https://github.com/ClickHouse/clickhousectl/pull/767), but that PR only makes informational stderr best-effort. General stdout behavior affects many commands and needs an explicit exit policy. Resetting SIGPIPE can yield signal exit 141, so it does not automatically meet the issue’s stated acceptance criteria.

---

## Original QA report

Found in the 2026-09-11 QA sweep of the combined PR stack at [`d2c37f81`](https://github.com/ClickHouse/clickhousectl/commit/d2c37f814fff53fe68d636e34103e2d0550bf84d), top PR #823, installed release build (package version still 0.4.2). Reproduced behaviour only; no implementation included.

Severity: high; latent in every list/dump command, surfaces on `| head`, `| grep -m1`, `| less` once output exceeds the pipe buffer.

```sh
clickhousectl cloud activity list | head -1
# thread 'main' panicked at library/std/src/io/stdio.rs:1165:9:
# failed printing to stdout: Broken pipe (os error 32)
# exit 101
```

Also reproduced on `cloud org usage`. Small lists (`key list`, `org quota list`) do not trip it because their whole output fits one write. #677 fixed the closed-*stderr* case; stdout `println!` is unguarded. Exit 101 is outside the documented 0/1/2/3/4 set.

Expected: exit cleanly on `ErrorKind::BrokenPipe` (reset `SIGPIPE` to default at startup, or route stdout through a writer that swallows `BrokenPipe`, as `print_line` already does for the late-output path in `postgres promote`).

Acceptance: subprocess test piping a large list into a closed reader asserts no panic and a documented exit code.

Start by tracing the unguarded stdout println! paths in the list and dump commands, then compare them with print_line’s BrokenPipe handling in the postgres promote late-output path. Review startup signal handling and the documented 0/1/2/3/4 exit codes. Done means the chosen stdout policy is documented and a subprocess test piping a large list into a closed reader shows no panic and the documented exit code.

Written by the indexing model from the issue text.