live-check: --fail-on flag for severity-based exit code

[cijothomas]

Today weaver registry live-check only exits non-zero on violation-level findings. Every CI consumer that wants a different threshold (improvement, information, none) ends up re-implementing the gating in a wrapper — e.g. the composite actions added in #1448 do this in a Python helper.

Add a --fail-on <violation|improvement|information|none> flag (and matching .weaver.toml field) so the CLI returns the right exit code itself.

Discussion: #1448 (comment)

[cijothomas]

Concrete consumer reference: open-telemetry/otel-arrow#3047 ships a weaver registry live-check job for df_engine internal events. Because weaver currently exits non-zero on any finding (including attribute-level), and the registry is built up incrementally, the job has to ignore weaver's exit code and re-implement a severity-scoped gate in jq over live_check.json:

https://github.com/open-telemetry/otel-arrow/blob/cijothomas/issue-1613-weaver-livecheck-mvp/.github/workflows/df-engine-internal-observability.yml

A --fail-on=violation (or similar) flag would let us drop that custom logic entirely.