feat(cli): implement the scan command and stable exit codes

[back1ash]

Summary

Provide the first end-user command that scans repository OpenAPI files through the shared PROOF core.

Scope

• Implement proof scan for one or more repository-relative specification paths.
• Support config path, output path, fail threshold, rule-pack identity, git ref, policy ref, and evaluation time inputs.
• Map pass or advisory, blocked, input or config error, and internal error to exit codes 0, 1, 2, and 3.
• Keep command execution non-interactive and deterministic.

Acceptance criteria

• Good and bad JSON and YAML fixtures run through the complete core.
• Exit codes 0 through 3 have integration tests.
• Invalid files, missing files, empty globs, bad config, and internal failures are distinguishable.
• The CLI never executes repository content or resolves remote references.
• Help text explains the static-analysis boundary and default gate.

Dependencies

• feat(core): define the P0 scan configuration contract #19
• feat(core): implement the supervised openapi-spec-validator worker #21
• feat(core): assemble normalized runs, fingerprints, and gate outcomes #24

Priority gate and claiming

Keep status:blocked until every open priority:p0 issue is closed
and every explicit dependency above is closed. Only then replace it
with status:ready and add help wanted.

To claim a ready issue, assign yourself, replace status:ready with
status:in-progress, and comment with a short implementation plan.

Non-goals

• GitHub App, HTTP URL inputs, interactive prompts, or automatic fixes.
• Markdown, SARIF, or baseline output.