patch: Graceful error when project type has no manifest support (closes #50)

[rdwj]

Closes #50.

Before this change, running `fips-agents patch check`, `patch `, or `patch all` against a project whose template type is not in the built-in category set (today: sandbox) AND does not ship a `.fips-template.yaml` manifest produced a Python traceback ending in `ValueError`.

Fix

Sentinel exception `PatchUnsupportedForProjectType`, raised by `_resolve_categories` when the manifest is unusable AND `get_categories_for_type` raises. Three CLI entry points catch it and emit a single-line ✗ message:

```
$ fips-agents patch check
✗ Patching is not supported for project type 'sandbox'. The template repo
for this project type does not yet ship a .fips-template.yaml manifest, and
no built-in category set exists for it. See
#45 for the manifest
schema.
```

Same shape for `patch chart` and `patch all`. All exit 1.

Call site changes

• `patch check` wraps `check_for_updates` in try/except.
• `patch_category` (used by every `patch ` subcommand) defers the pre-clone fast-fail when there is no built-in category set for the type, then catches `PatchUnsupportedForProjectType` post-clone and returns `(False, message)` so the existing red ✗ rendering kicks in.
• `patch all` wraps the pre-clone `get_available_categories` call and exits 1 cleanly. (Iterating manifest-declared categories without a Click subcommand for each is a bigger refactor — out of scope.)

Test plan

• 4 new unit cases in `TestPatchUnsupportedForProjectType` covering the exception type, message content, and that supported types (agent / mcp-server / workflow) still fall back to constants.
• 4 new integration cases in `TestPatchUnsupportedTypeE2E` against a fake sandbox project — `patch check`, `patch chart`, `patch all` all exit 1 with no traceback. A future-proofing test confirms that once sandbox ships a manifest, `patch check` works without further CLI changes.
• Full suite: 343 passed (was 334 on main → +9 new).
• `black src tests` clean.
• `ruff check src tests` clean.
• gitleaks clean.
• Manual e2e — scaffold a real sandbox project, verify each command produces a clean message and exits 1.

Out of scope

• Functional patch support for sandbox — that needs a `.fips-template.yaml` shipped in `fips-agents/code-sandbox`. This PR only ensures the failure mode is graceful, not the success mode.