fix(tools): okf_adjudicate exits 2 on a malformed plan

A SegmentationError raised by the plan grammar escaped main() as a
traceback and exit 1, while every other malformed-plan case in the same
file already returned 2. Exit codes are the interface a caller scripts
against, and exit 1 with a traceback is the code an unhandled bug
produces -- it says "this command broke" where the truth is "this file
is not a plan".

The refusal itself is unchanged: nothing was written before and nothing
is written now, and the grammar in src/ is untouched. What changes is
one line on stderr naming the error code, and the exit code.

Both branches that can raise are covered: the pre-write parse of a
non-empty plan, and the required-field check reached through the empty
branch.

The old behaviour was pinned by
test_an_entries_value_that_is_not_a_list_is_still_refused, which
asserted that a wrongly-typed `entries` reaches the caller as a raised
SegmentationError and recorded that as a finding rather than fixing it.
That test is rewritten here, in the same commit as the code, to assert
exit 2 plus the code on stderr. A second test pins the one-line stderr
shape on the non-empty branch.

Suite 1072 -> 1073 passed; ruff and mypy --strict clean.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -260,6 +260,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   construction; the explicit argument preserves that outcome across the bump.
   A consumer sees the same rejections, with the same reasons, before and after.
 
+### Fixed
+
+- **`tools/okf_adjudicate.py` exits 2 on a malformed plan instead of raising.**
+  A `SegmentationError` from the plan grammar used to escape `main()` as a
+  traceback and exit 1, while every other malformed-plan case in the same file
+  already returned 2. Exit codes are the interface a caller scripts against,
+  and exit 1 with a traceback says "this command broke" where the truth is
+  "this file is not a plan" -- the two are the same code an unhandled bug would
+  produce. The refusal itself is unchanged: nothing is written either way, and
+  the grammar is untouched. Now one line on stderr naming the error code, and
+  exit 2. A caller that treated a non-zero exit as failure sees no difference;
+  one that distinguished 1 from 2 sees a malformed plan move into the class it
+  belonged to. Pre-existing since the empty-verdict branch landed, and pinned
+  until now by a test that recorded it as a finding rather than fixing it.
+
 ## [0.5.0a2] — 2026-07-31
 
 **This is the pre-release the pilots pin. `v0.5.0a1` was tagged and abandoned