Restructure error handling in main()

Fixes #310 (closed)

Alternative to !632 (closed)

As #310 (closed) shows, error handling in main() is messy, with some errors being logged but otherwise ignored.

This change introduces a new function run() which returns an error. The end effect is that all errors are fatal now. Inside run() we can just use normal if err != nil { return err } control flow. This is good because humans reading Go are not used to looking for "this Error("foo") should be Fatal("foo")", but they are used to looking for unhandled errors.

As a side effect, defer statements in main() that were no-ops will now actually do something: when you call log.Fatal() deferred functions don't run, but when you return err, they do. Actually, these defer calls are still no-ops, because we don't install any signal handlers, and SIGTERM takes down the process without ever running the deferred calls.