SiteConfigMerge: frame checks as plan tripwires; exit 3 on warnings

Per operator: under the SiteLink IP plan there should never be
GUID/MAC/IP conflicts. Reframed the merge checks accordingly - they
are tripwires for plan drift (un-renumbered site) or stale inventory
(same pod recorded in two site files), not expected events. The merge
now exits 3 when any warning fired (master still written) so event-day
scripts can gate on a clean merge; 0 = clean, 1 = usage, 2 = hard
error. Verified: same-file-twice merge exits 3, clean merge exits 0.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tools/SiteConfigMerge/Program.cs

@@ -149,10 +149,25 @@ Usage:
             SiteConfigFile.Write(output, merged, binder);
             Console.WriteLine($"wrote {output}: {merged.Count} squad(s), {merged.Sum(s => s.Pods.Count)} pod(s) " +
                               $"(identity: {binder.CapturedAssembly ?? TeslaBinder.DefaultAssembly})");
+            if (mWarnings > 0)
+            {
+                // Under the SiteLink IP plan none of the consistency checks should ever
+                // fire; a warning means plan drift (un-renumbered site) or stale
+                // inventory (same pod in two site files). Exit 3 so event scripts can
+                // gate on a clean merge.
+                Console.Error.WriteLine($"{mWarnings} warning(s) — master written, but resolve these before the event.");
+                return 3;
+            }
             return 0;
         }
 
-        private static void Warn(string message) => Console.Error.WriteLine("WARNING: " + message);
+        private static int mWarnings;
+
+        private static void Warn(string message)
+        {
+            mWarnings++;
+            Console.Error.WriteLine("WARNING: " + message);
+        }
 
         private static string FormatMac(byte[] mac) =>
             mac == null || mac.Length == 0 ? "none" : BitConverter.ToString(mac).Replace('-', ':');