runner.rs: load_config_or_default and commands/bench.rs exit sites still bypass guard-flush

[bug-ops]

Description

Follow-up from #6698 (fixed via PR #6708). While reviewing that fix, impl-critic and the code reviewer independently found the identical guard-flush-bypass bug pattern (a std::process::exit that skips TracingGuards::drop's take-once-cell flush logic, same class as #6696/#6697/#6698) at two more call sites reachable from run() after init_tracing (src/runner.rs:867) — but they were not named in #6698's scope and were intentionally left untouched to keep that PR focused.

Sites

• src/bootstrap/config.rs:27 (load_config_or_default, exits on config parse error) — reachable via Command::Classifiers (src/runner.rs:1060).
• src/commands/bench.rs — 7 std::process::exit call sites (lines 290, 294, 370, 396, 467, 475, 527) — reachable via the Bench command dispatch in run().

Note: src/runner.rs:815's exit call is before init_tracing, so it is genuinely safe and out of scope here.

Expected Behavior

Same fix pattern as #6698: either thread a flush handle through to these call sites, or have them return an exit-code signal to a caller that already has tracing_guards in scope (as handle_url_open was refactored to do in #6708). load_config_or_default and the bench.rs functions are called from multiple places, so the design work here is larger than #6698's — determine which call sites actually need this vs. which callers are pre-init-tracing and safe.

Environment

• Version: unreleased (main, as of 2026-07-28), post-fix(cli): flush tracing guards on remaining runner.rs exit paths #6708 merge
• Relevant code: src/bootstrap/config.rs (load_config_or_default), src/commands/bench.rs, src/runner.rs (Command::Classifiers, Command::Bench dispatch, init_tracing call site)