fix(scan): fail closed instead of crashing Coana when --dynamic-sbom-inference finds no JVM build root

[Jeppe Fredsgaard Blaabjerg (jfblaa)]

Summary

• socket scan create --reach --dynamic-sbom-inference on a target with no Gradle/sbt/Maven build root at all (e.g. a plain npm workspace) crashed Coana with --maven-use-only-socket-facts requires --compute-artifacts-sidecar to also be provided.
• Root cause: --maven-use-only-socket-facts was passed to Coana whenever dynamicSbomInference was true, regardless of whether a sidecar was actually generated.
• Fix: an empty sidecar ({}) is now always written whenever dynamicSbomInference is on, and --maven-use-only-socket-facts is always passed alongside it. This matters beyond just preventing the crash: without a sidecar to back it, dropping the flag entirely would let Coana silently fall back to resolving the Maven ecosystem from whatever else it finds (a stray CDX/SPDX SBOM, etc.), defeating the whole point of --dynamic-sbom-inference. An empty sidecar instead makes Coana correctly report nothing reachable there.
• Separately, socket scan create --dynamic-sbom-inference (and its manifest-side siblings, see below) now fail closed with a clear message when the recursive scan finds no Gradle/sbt/Maven build root at all anywhere under the target — the flag doesn't apply there, so this is very likely a mistake (wrong --cwd, or the flag copied into the wrong project). This is a distinct, narrower check from the sidecar fix above: build roots that are legitimately discovered but end up empty (no resolvable dependencies) or skippedDisabled (disabled via socket.json) don't trigger it — those are expected outcomes, already warned about individually, and now handled correctly by the empty-sidecar fallback rather than aborting the scan.
• Same treatment applied to the two sibling commands, for consistency with socket manifest auto's existing "nothing detected" failure:
  • socket manifest dynamic-sbom-inference (previously printed Generated 0 Socket facts file(s). with exit 0 even when nothing was found).
  • socket manifest setup --dynamic-sbom-inference (previously printed Recursive setup complete. with exit 0 even when nothing was found).

Linear: REA-710

Test plan

• New tests in perform-reachability-analysis.test.mts covering: no sidecar entries + dynamicSbomInference on (writes an empty sidecar, still passes both flags), a real sidecar, and dynamicSbomInference off.
• New test in handle-create-new-scan.test.mts asserting the abort when zero build roots are discovered, and a regression test proving discovered-but-empty/disabled roots do NOT wrongly abort.
• New test file handle-manifest-dynamic-sbom-inference.test.mts covering the no-build-root / partial-failure / success cases.
• New tests in setup-recursive-manifest-config.test.mts covering the fail-closed case and the "excluded, not absent" case.
• pnpm test:unit across src/commands/manifest + src/commands/scan — 463/463 pass
• pnpm run check:tsc clean
• pnpm run lint clean

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 1876e5e. Configure here.}

[Martin Torp (mtorp)]

LGTM ✅