Install: follow-up style cleanup for InstallSafeDITool + Xcode build plugin

[dfed]

Summary

Style-guide follow-up to #273. CLAUDE.md bars bare `if { return|throw }` patterns with implicit fall-through — the non-returning path has to sit in an explicit `else`.

Changes

• `Plugins/InstallSafeDITool/InstallSafeDITool.swift` — HTTP status check for the downloaded asset. The old
  ```swift
  if let httpResponse = response as? HTTPURLResponse,
  !(200..<300).contains(httpResponse.statusCode)
  {
  throw DownloadFailedError(...)
  }
  ```
  falls through on 2xx. Restructured to
  ```swift
  if let httpResponse = response as? HTTPURLResponse {
  guard (200..<300).contains(httpResponse.statusCode) else { throw ... }
  }
  ```
  Same runtime behavior.

• `Plugins/SafeDIGenerator/SafeDIGenerateDependencyTree.swift` — Xcode variant's real-scan / `PluginScanner` split. The old `if runsRealScan { do-return-catch } ...` block returned from inside the `if` and fell through on `SafeDIToolLaunchError`. Extracted:

  • `buildCommandsUsingRealScan(...)` — returns `nil` on recoverable launch failure, lets `SafeDIToolProcessError` propagate
  • `buildCommandsUsingPluginScanner(...)` — regex-based fallback

  Caller is now
  ```swift
  if runsRealScan, let commands = try buildCommandsUsingRealScan(...) {
  return commands
  } else {
  return buildCommandsUsingPluginScanner(...)
  }
  ```
  Both branches return. Runtime behavior unchanged: `ProcessError` still surfaces, `LaunchError` still warns + falls to scanner.

What this doesn't do

• Binary checksum / code signature verification for the downloaded tool (codex P1 on Plugins: restore InstallSafeDITool download command for Xcodeproj users #273). Current controls are Gatekeeper (macOS signing + notarization at `Process.run` time) and the `--version` match in `verifiedDownloadedToolLocation`. A full checksum-pin would mirror `SafeDIToolBinary`'s checksum and needs publish-workflow coordination — separate PR.

Test plan

• `swift build --traits sourceBuild` — builds clean
• `./CLI/lint.sh`
• Plugin code is non-unit-testable; no test changes. Existing CI covers the `buildCommandsUsingPluginScanner` path via `spm-project-integration` and `spm-multi-project-integration` (they exercise the Xcode build plugin through `xcodebuild`).

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (75846d3) to head (52d2a24).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #277   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           41        41           
  Lines         6796      6796           
=========================================
  Hits          6796      6796           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.