[dbdefault]

Closes #48

Why

--fail-on and --max-cost both exited 2, so CI could not tell a findings-policy failure from a budget overrun without parsing JSON.

What

• New EXIT_COST_EXCEEDED = 3 in cli.py; the exit code is now resolved once and reused for both the --json document (exit_code) and typer.Exit.
• Precedence: run failure 1 > cost gate 3 > findings gate 2 > 0. If both gates trip, 3 wins so the budget overrun is visible; the JSON still carries both gate verdicts.
• --help docstring and docs/REFERENCE.md (flag table and exit-code paragraph) updated.

Tests

test_max_cost_trips_when_summed_spend_exceeds_cap now asserts exit 3 and exit_code == 3 in the JSON. It failed before the change (exit 2) and passes after.

Verification

• PYTHONPATH=src python -m pytest tests/test_cli.py -p no:llmsectest: 55 passed. (The editable install timed out on litellm here, and a global pytest plugin that is not installed had to be disabled.)
• ruff check: no new violations in the changed files vs origin/main (existing ones remain).
• Full pytest tests was not run for this PR.

Note

This changes the exit code existing users get from --max-cost, from 2 to 3. If you would rather keep 2 and add a separate signal, I can rework it.