fix(scan): finalize tier1 reachability scan from socket scan reach

[Benjamin Barslev Nielsen (barslev)]

Summary

socket scan reach (standalone reachability analysis) spawns Coana, which registers a tier1 reachability scan row via the Socket backend. Until now socket-cli never followed that up with a finalize call from this flow — there was no full-scan id to bind to, so the row stayed at an intermediate post-Coana state forever and looked identical to a stuck scan create --reach.

With the tier1 reachability finalize endpoint now accepting a null report_run_id, socket scan reach can drive the row to its DONE terminal state directly. The intermediate post-Coana state becomes an unambiguous "something went wrong" signal again.

Changes

• src/commands/scan/finalize-tier1-scan.mts — broaden the second argument from string to string | null (mirrors the finalize endpoint's relaxed schema). No-op for existing call sites that pass a real scan id.
• src/commands/scan/handle-scan-reach.mts — after performReachabilityAnalysis returns successfully and yields a tier1ReachabilityScanId, POST /tier1-reachability-scan/finalize with report_run_id: null. Failure logs a warn and falls through to the normal output (this is metadata-only; never block the user-visible result on it).
• src/commands/scan/handle-scan-reach.test.mts — mock the new dependency and add two focused tests: one verifying finalizeTier1Scan('tier1-id', null) is invoked when Coana emits a scan id, one verifying it is NOT called when Coana emits undefined.

Test plan

• pnpm check:tsc clean
• pnpm test:unit src/commands/scan/handle-scan-reach.test.mts — 6/6 (4 existing + 2 new)
• pnpm test:unit src/commands/scan/ — 177/177

---

Note

Medium Risk
Replaces core build/lint/CI and packaging entrypoints, which can break releases or developer workflows if any config mismatch slips through. No direct product logic changes are evident, but the surface area touched (Rollup, ESLint, GitHub Actions, bins) is broad.

Overview
Reworks the project’s build + distribution pipeline by adding new Babel/Rollup configs (including dist bundling that copies/rewires external/ deps) and switching runtime entrypoints to new bin/*.js wrappers that execute the built dist outputs.

Overhauls developer tooling and CI: replaces legacy ESLint setup with a flat eslint.config.js, adds Biome/Oxlint configs, new .env.* profiles, Husky hooks (lint-staged + commit PII guard), and new GitHub Actions workflows for lint/typecheck/test/e2e and npm publish with provenance.

Repo hygiene/docs updates: expands .gitignore/.editorconfig, removes old cli.js + lib/ command implementation, drops Dependabot config, and refreshes README.md/CHANGELOG.md plus a new Claude skill for bumping @coana-tech/cli.

^{Reviewed by Cursor Bugbot for commit 129adae. Configure here.}