fix: treat the operator JSON result as authoritative across exit codes

tools/thothctl/internal/workspaceops/operations.go

@@ -293,15 +293,16 @@ func Execute(ctx context.Context, installation config.Installation, runner Runne
 		return Result{}, err
 	}
 	result, err := runDocker(ctx, runner, StageComposeRun, args, bytes.NewReader(stdin))
-	// The operator deliberately exits 3 for expected operator checkpoints/blocks
-	// (manual_review_required, evidence_materialization_required, lock/revision conflict).
-	// That exit is a valid machine result: the JSON payload on stdout is still authoritative.
-	if err != nil && !isExpectedOperatorExit(result, err) {
-		return Result{}, err
-	}
-	response, err := parseResponse(result.Stdout)
-	if err != nil {
-		return Result{}, err
+	// The operator emits one authoritative JSON result on stdout and encodes its status in the
+	// exit code (0 success, 3 operator checkpoint/block, 1 operational failure). A nonzero
+	// exit is therefore still a valid machine result whenever stdout parses; only a missing or
+	// malformed payload becomes an error.
+	response, parseErr := parseResponse(result.Stdout)
+	if parseErr != nil {
+		if err != nil {
+			return Result{}, err
+		}
+		return Result{}, parseErr
 	}
 	if suggest, ok := request.(SuggestFksRequest); ok && suggest.Output != "" {
 		if response.SuggestedFksYAML == "" {