Allow 2 as exit code when non-agent cert submit

We have nodes with more-than-just-an-agent ensure they've
checked in prior to signing certs (in case they do not follow default
naming schemes). Unfortunately in some cases the agent will also change
the system, returning 2. This is valid behavior.