osv-scan: derive scan targets from git ls-files, never the directory walk

[bdelanghe]

Closes bounded-systems/.github#103 — the class fixed in .github#102 for repo-standard.yml, ported to the reusable lane every deps.yml caller uses.

The defect

osv-scanner's -r walk applies .gitignore patterns without git's tracked-file exemption, so a repo that lists its own committed lockfile in .gitignore has it silently skipped, and --allow-no-lockfiles converts "extracted nothing" into exit 0. hooksmith#108 shipped sixteen advisories behind that green for months.

The fix

• New Discover scan targets step — tracked lockfiles from git ls-files against the same basename list as repo-standard.yml (deno.lock deliberately absent there and here), plus the convert step's generated deno-lock.cdx.json SBOMs via find (untracked by construction, so they can't come from ls-files). Explicit --lockfile= args replace scan source -r --allow-no-lockfiles ..
• "Scanned nothing" ≠ "scanned and clean" — zero targets is a logged ::notice:: explicit pass with the scan step skipped; an empty target list reaching the scan step anyway is a hard red. --allow-no-lockfiles is gone entirely.
• Convert step's deno.lock discovery moves find → git ls-files, same authority principle.
• Exit-code triage, report-only, and grace-expires behavior untouched (all 13 existing posture/grace tests pass unchanged).
• New Discovery test suite in test_scan_posture.py runs the step's actual run: block against synthesized git repos — centered on the gitignored-but-tracked lockfile regression case. flake.nix lends the suite gitMinimal (same parity shape as env-record borrowing nodejs).

Verification — the Extract calls counter, as .github#103 asks

Synthesized hooksmith-shape repo (tracked package-lock.json carrying lodash 4.17.20, listed in .gitignore, plus the synthetic deno.lock fixture), scanned with the pinned v2.4.0 binary:

invocation	Extract calls	result
old: scan source -r --allow-no-lockfiles .	0 — No package sources found	exit 0 (green, blind)
new: explicit targets from discovery	2	3 known vulnerabilities (1 High, 2 Medium) → exit 1 hard; exit 0 + ::warning:: under report-only

Against this repo itself (what self-test's scan job runs): fixture deno.lock converted → 1 scan target → 1 Extract calls → 0 vulnerabilities → exit 0.

Not in this PR

• Caller pin bumps — merge triggers release-tag (paths include this workflow), which mints the next patch tag; Dependabot rewrites the fleet's SHA pins from there. No template bytes changed, so no caller drift is introduced.
• Caller-repo before/after sweep — hooksmith, repo-health, and front-desk-scheduler aren't in this session's scope; .github#103 records the by-hand sweep that found no other hidden lockfile, and this change makes that sweep unnecessary going forward.

🤖 Generated with Claude Code

https://claude.ai/code/session_016JEQgLpoVWWs82ykpqMBL3