[Feature] add a configurable failure policy for incomplete scans

[luojiyin1987]

Background

PR #893 introduces ScanCompleteness and reports partial scan data when advisory detection or remediation steps cannot be completed.

The current CLI surfaces these diagnostics in terminal, JSON, and HTML output. However, outside of ratchet mode, scan completeness does not affect the process exit code.

This means a scan with detection-impact gaps may still exit successfully when no resolved findings reach the configured --fail-on threshold.

Problem

For local interactive usage, warning without failing is reasonable.

For CI and security gates, users may want an incomplete vulnerability scan to fail closed because the absence of findings cannot be trusted when advisory detail data is missing.

Changing the default exit behavior would be backwards-incompatible, so this should be configurable.

Proposed solution

Add an explicit incomplete-scan policy, for example:

--incomplete-policy warn|error

Suggested behavior:

• warn — print and serialize completeness diagnostics without changing the exit code; this remains the default.

• error — return EXIT_ERROR when any relevant completeness diagnostic is present.

• Consider allowing separate handling for:

  • detection-impact diagnostics;
  • remediation-only diagnostics.

Detection gaps should normally be treated more strictly because they can change the finding set. Remediation-only gaps do not invalidate vulnerability detection results.

The GitHub Action should expose the same option as an input.

Acceptance criteria

• Default behavior remains backwards-compatible.
• A detection-impact incomplete scan exits successfully under warn.
• The same scan exits with an error under error.
• Remediation-only behavior is explicitly defined and tested.
• Single-folder and multi-folder modes use the same policy.
• JSON and terminal output remain available before the process exits.
• GitHub Action documentation includes the new input.

Related work

• PR feat: report incomplete scan data with diagnostics #893
• Ratchet mode already rejects baselines when detection data is incomplete.

[sonukapoor]

Thanks @luojiyin1987 - this makes sense as a follow-up once #893 (the ScanCompleteness diagnostics) lands, since it builds directly on that infrastructure. Sequencing it behind #893.