fix: treat operator checkpoint exit 3 as a valid machine result

tools/thothctl/internal/workspaceops/operations.go

@@ -292,7 +292,10 @@ func Execute(ctx context.Context, installation config.Installation, runner Runne
 		return Result{}, err
 	}
 	result, err := runDocker(ctx, runner, StageComposeRun, args, bytes.NewReader(stdin))
-	if err != nil {
+	// The operator deliberately exits 3 for expected operator checkpoints/blocks
+	// (manual_review_required, evidence_materialization_required, lock/revision conflict).
+	// That exit is a valid machine result: the JSON payload on stdout is still authoritative.
+	if err != nil && !isExpectedOperatorExit(result, err) {
 		return Result{}, err
 	}
 	response, err := parseResponse(result.Stdout)
@@ -722,6 +725,14 @@ func ownedContainerName(installation config.Installation, request Request) strin
 	return strings.Join(parts, "-")
 }
 
+func isExpectedOperatorExit(result compose.Result, err error) bool {
+	if err == nil || result.ExitCode != 3 {
+		return false
+	}
+	var operationErr *OperationError
+	return errors.As(err, &operationErr) && operationErr.class == ExitClassNonzero
+}
+
 func runDocker(ctx context.Context, runner Runner, stage Stage, args []string, stdin ...io.Reader) (compose.Result, error) {
 	var input io.Reader
 	if len(stdin) > 0 {