feat(proxy): report blocked packages on stop, exit 1 if any were blocked

pmg proxy stop now waits for the proxy process to exit, reads the final
blocked count written to the state file on shutdown, and exits non-zero
when one or more packages were blocked during the session.

This gives CI a clear failure signal from the proxy itself, separate
from the package manager's own exit code.

.github/workflows/persistent-proxy-e2e.yml

@@ -75,19 +75,13 @@ jobs:
           echo "SUCCESS: lodash installed through proxy"
           cd .. && rm -rf benign-test
 
-      - name: Malicious package is blocked
+      - name: Malicious package is blocked (npm exits non-zero)
         run: |
           mkdir malicious-test && cd malicious-test
           npm init -y
-          if npm --no-cache --prefer-online install safedep-test-pkg@0.1.3; then
-            echo "ERROR: safedep-test-pkg was not blocked!"
-            exit 1
-          fi
-          if [ -d "node_modules/safedep-test-pkg" ]; then
-            echo "ERROR: safedep-test-pkg found in node_modules!"
-            exit 1
-          fi
-          echo "SUCCESS: safedep-test-pkg blocked by persistent proxy"
+          npm --no-cache --prefer-online install safedep-test-pkg@0.1.3 && exit 1 || true
+          test ! -d node_modules/safedep-test-pkg
+          echo "SUCCESS: npm correctly failed to install safedep-test-pkg"
           cd .. && rm -rf malicious-test
 
       - name: pip installs through proxy
@@ -97,6 +91,10 @@ jobs:
           python -c "import requests; print('pip ok:', requests.__version__)"
           deactivate && rm -rf venv
 
-      - name: Stop proxy
-        if: always()
-        run: pmg proxy stop || true
+      - name: Stop proxy (exits 1 when packages were blocked)
+        run: |
+          if pmg proxy stop; then
+            echo "ERROR: pmg proxy stop should have exited non-zero (packages were blocked)"
+            exit 1
+          fi
+          echo "SUCCESS: pmg proxy stop correctly reported blocked packages"