v0.4.4 feedback: concise CLI failures and --debug

[CAOShurong]

VulnFuse v0.4.4 changes the default failure surface of the CLI after a real public-artifact check found that a missing report produced 31 lines of Node.js internals.

Release: https://github.com/CAOShurong/vulnfuse/releases/tag/v0.4.4

Issue and implementation context:

• Print concise runtime errors unless --debug is requested #11
• Print concise CLI runtime errors #12

Report-input and runtime failures now print one vulnfuse: <message> line to stderr and return exit code 1. Stdout remains clean, and a failed input does not create the requested output. The explicit global --debug option restores the stack when diagnosis requires it. Policy gates such as --fail-on high still write the report before returning 1.

This does not suppress Commander's normal help for command-syntax errors, and --debug is not sanitized: it can expose local paths. Review debug logs before sharing them.

Useful feedback would include:

• the operating system, shell, Node.js version, and exact VulnFuse command;
• the observed exit code and whether stdout/stderr were usable in CI;
• a sanitized one-line default diagnostic that lost information needed to correct the problem;
• a case where --debug failed to retain enough information for a bug report.

Please remove credentials, internal repository names, hostnames, package inventories, and sensitive paths before posting. For a reproducible defect, open an issue with the smallest safe fixture or reproduction steps.