improve puppet error checks

Nicer to have this as a single Nagios check instead of 2. Also count failed resource as failures since this don't get reported under events (what's the difference?).