Contain arbitrary plugin and runtime failures even when a thrown Proxy traps instanceof checks or its string coercion throws. Fall back to a stable diagnostic instead of letting executeCli reject outside its exit-code contract.
Route abort reasons through the same total renderer so cancellation cannot escape containment through an exotic reason value.
Add a focused regression that exercises both hostile inspection paths and verifies stdout remains empty, stderr remains labelled, and the CLI resolves with exit code 1.
Report context-disposal failure as an independent outcome even when argument, boot, task, or output handling has already produced a primary diagnostic.
Keep the primary error first, append the cleanup error, and retain the nonzero exit status so operators can see both the initiating failure and the possibility that teardown or persistence did not complete.
Add a regression that combines an invalid app composition with a failing disposer and asserts both ordered stderr lines.
Race Loader startup with the process abort signal so SIGINT and SIGTERM can settle the one-shot CLI even when initialization has not returned a Context.
If boot settles after cancellation, dispose the late context asynchronously instead of recreating the wait. Contain late boot rejection and report a late disposal failure on stderr.
Cover prompt interruption, late context disposal, late boot rejection, and cleanup failure with focused CLI regressions.
