fix(cmd): report CLI errors without panics

[taigrr]

Summary

• add a shared CLI fatal helper that writes failures to stderr
• replace command panics with contextual error messages and stable nonzero exits
• update the Go directive to 1.27.1 so CI govulncheck uses a fixed standard library

Tests

• go generate ./...
• go test -race ./...
• staticcheck ./...
• govulncheck ./...