some `staticExec`s should check the exit code

## Example

1. Download [a source archive for chalk](https://github.com/crashappsec/chalk/archive/refs/tags/v0.3.2.tar.gz)
2. Extract it
3. `cd` to the extracted location
4. Run `nimble build`

This is relevant for packaging chalk - see https://github.com/crashappsec/internal_tickets/issues/138.

## Expected behavior

The build succeeds, and chalk is fully functional. In particular, a `chalk insert` should insert a chalk mark that contains the git commit ref from which chalk was built, like:

```json
"COMMIT_ID": "e50885d33aa5e66fc75cb8e8f133c2159c6d052a",
```

## Observed behavior

The build succeeds, but then a `chalk insert` inserts a chalk mark with a bad `COMMIT_ID` value, which contains an error message instead of a commit ref.

The `chalk version` output has the same issue:

```console
$ chalk version | grep commit
┊ Commit ID ┊ fatal: not a git repository [etc] ┊
```

## Diagnosis

We have some `staticExec` that silently use the command's output even when the command indicates an error:

https://github.com/crashappsec/chalk/blob/cf9ebf8476bf3e3a2399512673e2ccc12dbb8aeb/src/chalk_common.nim#L362-L364

https://github.com/crashappsec/chalk/blob/cf9ebf8476bf3e3a2399512673e2ccc12dbb8aeb/src/attestation.nim#L13-L14

These should use `gorgeEx`, or some wrapper around that.

Start by reproducing the chalk archive build with `nimble build`, then inspect `src/chalk_common.nim` around lines 362-364 and `src/attestation.nim` around lines 13-14. Check how the cited `staticExec` calls handle command errors and compare them with `gorgeEx` or a wrapper. Done means `chalk insert` and `chalk version` report the commit ref rather than the git error output.

Written by the indexing model from the issue text.