Unify CLI config-failure exit codes via a single ConfigError catch

[bencehezso]

Summary

Config-resolution failures had two inconsistent conventions: non-interactive paths called sys.exit(codes.CONFIG), while interactive paths (--profile, --cli, manual prompts) and the --config <bad file> path just returned - meaning the process exited 0 on those failures. A CLI that exits 0 on failure silently breaks any script wrapping it (set -e, &&, $? checks).

This PR routes every config failure through the ConfigError seam introduced in the config-resolution refactor (#50) and maps it to an exit code in exactly one place.

What changed

• handle_aws / handle_azure: the --config-file failure now raises
  ConfigError instead of returning, and all six per-branch
  try/except ConfigError blocks were removed — resolvers now propagate freely.
• main(): a single except ConfigError: sys.exit(codes.CONFIG) wraps the
  provider dispatch, so file and credential failures — interactive or not — all
  exit 2 from one choke point.