test(go): step 6 — integration tests covering all exit codes and output

Extract run(args, stdout, stderr) int from main() for in-process
testability. Fix TLS failure classification (tlsErr now captured from
TLSHandshakeDone hook). Add run_test.go with 14 table-driven in-process
tests and cli_test.go with TestMain + 3 subprocess smoke tests. All
servers use httptest; .invalid TLD for deterministic DNS failures.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

CHANGELOG.md

@@ -4,6 +4,16 @@ All completed features are logged here in reverse-chronological order.
 
 ---
 
+## 2026-07-01 00:49 — Integration tests (Go, Step 6)
+
+- Extracted `run(args, stdout, stderr) int` from `main()` to make the CLI testable in-process
+- Fixed TLS classification bug: `TLSHandshakeDone` fires with the error on cert rejection, so `tlsErr` is now captured and checked before the stale `tlsStart.IsZero()` guard
+- `run_test.go`: 14 in-process tests covering exit codes 0–6, multi-URL, sampling, and JSON structure assertions
+- `cli_test.go`: `TestMain` builds the real binary; 3 subprocess smoke tests exercise the actual `os.Exit` path
+- All test servers use `httptest` + stdlib; `.invalid` TLD for deterministic DNS failures; no external network dependency
+
+---
+
 ## 2026-07-01 00:38 — Failure handling (Go, Step 5)
 
 - Classified network failures into `dns` / `connect` / `timeout` / `tls` with distinct exit codes (2–5)