Fail supervised scans on incomplete coverage (#573)

## Summary
- Propagate supervised inventory resolver failures rather than hiding
process-substitution errors.
- Fail when no supervised repositories resolve, preventing false-green
scans.
- Return failure when any repository scan fails.

## Validation
- 
- �[0;31m[ERROR]�[0m Failed to resolve supervised repository inventory
exits 1.
- Automation quarantine, directive census, session-detritus, and
dispatch-path tests pass.
- Retired-descriptile test could not run because Ruby is unavailable;
repository-wide syntax scan reports a pre-existing syntax error in .

Co-authored-by: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>
Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>

Author: 3 people

fleet-coordinator.sh

@@ -155,11 +155,18 @@ scan_supervised_repos() {
     fi
 
     local -a repo_paths
-    mapfile -t repo_paths < <("$list_script" "${args[@]}")
+    local resolved_repos
+    if ! resolved_repos=$("$list_script" "${args[@]}"); then
+        log_error "Failed to resolve supervised repository inventory"
+        return 1
+    fi
+    if [[ -n "$resolved_repos" ]]; then
+        mapfile -t repo_paths <<< "$resolved_repos"
+    fi
 
     if [[ "${#repo_paths[@]}" -eq 0 ]]; then
-        log_warn "No supervised repositories resolved"
-        return 0
+        log_error "No supervised repositories resolved; refusing a false-green scan"
+        return 1
     fi
 
     log_info "Scanning ${#repo_paths[@]} supervised repos"
@@ -176,6 +183,11 @@ scan_supervised_repos() {
 
     log_info "Supervised scan complete: scanned=$scanned failed=$failed"
 
+    if [[ "$failed" -gt 0 ]]; then
+        log_error "Supervised scan incomplete: $failed of ${#repo_paths[@]} repositories failed"
+        return 1
+    fi
+
     if [[ "$process_after" == true ]]; then
         process_findings
     fi