CLI binaries report engine-integrity faults distinctly instead of generic exit 1

Summary

Extend the engine-integrity-fault abort policy to the shared CLI error handler, TGocciaApplication.Run (source/units/Goccia.Application.pas), so every GocciaScript binary reports corruption distinctly instead of as a generic failure.

Why

ADR 0109 makes integrity faults (use-after-free, invalid dereference, broken heap — Goccia.EngineFault.IsEngineIntegrityFault) uncatchable by guests, and the test runner aborts on them with a distinct diagnostic and exit 70. But faults raised outside per-file test execution — during startup, module loading, or in any other binary (loader, REPL, bundler, benchmark runner) — still land in TGocciaApplication.Run's generic on E: Exception arm and become a plain exit 1 with no Integrity fault: line. ADR 0109's host-tier section records this as a known residual boundary whose closure "is a change to every CLI binary and belongs to its own decision" — this issue is that decision.

Current behavior

TGocciaApplication.Run (~line 63): on E: Exception do HandleError; Result := 1 — an EAccessViolation during, say, engine setup in the loader is indistinguishable from an ordinary script error at the exit-code level, and prints no corruption diagnostic.

Expected behavior

• The shared arm checks IsEngineIntegrityFault(E) first: greppable diagnostic to stderr (class + message, mirroring the runner's Integrity fault: prefix), then terminate with exit 70 (docs/contributing/cli-conventions.md already documents 70 as EX_SOFTWARE for this class) using the no-finalization terminate the runner ships (TerminateProcessNow — consider hoisting it from GocciaTestRunner.dpr into a shared unit rather than duplicating the platform bindings).
• Ordinary exceptions keep today's behavior exactly (HandleError, exit 1).
• ADR 0109's "known residual boundary" paragraph is updated to record the closure.

Scope notes

• Touches every CLI binary through one shared arm — behavior change is deliberately uniform; per-binary carve-outs are a non-goal.
• Verify exit-code expectations of callers first: scripts/run_test262_suite.ts treats loader exitCode > 1 as WRAPPER_INFRA and scripts/test-es-toolkit-validation.ts has a similar > 1 pattern — decide whether 70-from-the-loader should be surfaced differently there or whether their classification is already correct for "engine corrupted".
• Related: ADR 0109 host tier, #1166 (injection-hook coverage could exercise this arm too once both exist), stack #1159 (#1163).

Start with source/units/Goccia.Application.pas and compare its generic exception arm with the runner behavior in GocciaTestRunner.dpr. Check docs/contributing/cli-conventions.md, ADR 0109, and the two named TypeScript scripts for exit-code assumptions. Done means integrity faults consistently produce the documented diagnostic and exit 70 while ordinary exceptions retain exit 1.