fix(cli): report a clean error when wingfoot sign can't reach the URL

[ebarkhordar]

Problem

http.request deliberately returns a Response for 4xx/5xx (no exception), but a connection failure — DNS error, connection refused, timeout — has no HTTP status, so it propagates as urllib.error.URLError. cmd_sign calls http.request without catching it, so a wingfoot sign against an unreachable URL dumps a raw Python traceback:

$ wingfoot sign http://127.0.0.1:1/
Traceback (most recent call last):
  ...
urllib.error.URLError: <urlopen error [Errno 61] Connection refused>

doctor already guards against this (via _safe_request); sign didn't.

Fix

Catch urllib.error.URLError in cmd_sign and print a concise message to stderr, returning exit code 1:

$ wingfoot sign http://127.0.0.1:1/
Could not reach http://127.0.0.1:1/: [Errno 61] Connection refused

Tests

Added to tests/test_cli.py:

• test_sign_reports_connection_error_cleanly — a URLError from the request becomes a clean stderr message + exit 1 (no traceback).
• test_sign_print_only_needs_no_network — --print-only never touches the network.

Full suite: 47 passed (45 + 2 new).