Add hidden reach-continue-on-* flags for Coana v15

[Martin Torp (mtorp)]

Summary

Preparation for the upcoming Coana CLI v15 major release.

Coana v15 changes the default halt behavior in socket mode for four different failure conditions, and introduces matching --reach-continue-on-* flags to opt out of each halt. This PR adds those four flags to the Python CLI as hidden argparse options (via help=argparse.SUPPRESS) and forwards them through ReachabilityAnalyzer.run_reachability_analysis to the spawned coana run command. Nothing changes for users today — the flags are no-ops against the current default Coana version — but the Python CLI will forward them as soon as Coana v15 becomes the default.

New flags (all hidden from --help)

Python CLI flag	Forwards to Coana	Halt it opts out of
--reach-continue-on-analysis-errors	--reach-continue-on-analysis-errors	Timeouts, OOM, parse errors, low-confidence results
--reach-continue-on-install-errors	--reach-continue-on-install-errors	Package installation failures
--reach-continue-on-missing-lock-files	--reach-continue-on-missing-lock-files	Gradle/SBT projects missing lockfile / version catalog / pre-generated SBOM
--reach-continue-on-no-source-files	--reach-continue-on-no-source-files	Workspace with no source files for its ecosystem

When the flag is set, the corresponding argument is appended to the coana run argv; when it's unset, nothing is appended and Coana applies its own default.

Files touched

• socketsecurity/config.py — CliConfig fields, argparse options (help=argparse.SUPPRESS), and config_args wiring
• socketsecurity/core/tools/reachability.py — new continue_on_* kwargs on run_reachability_analysis + argv forwarding
• socketsecurity/socketcli.py — pass config values through to the analyzer

Test plan

• All 33 tests in tests/unit/test_config.py + tests/unit/test_cli_config.py pass
• Manual parse check: all four flags resolve to True on the config when passed
• Manual --help check: all four flags are absent from help output
• Smoke-test against a Coana v15 build once one is available to confirm the flags propagate end-to-end

🤖 Generated with Claude Code

[github-actions]

🚀 Preview package published!

Install with:

pip install --index-url https://test.pypi.org/simple/ --extra-index-url https://pypi.org/simple socketsecurity==2.2.85.dev2

Docker image: socketdev/cli:pr-191