Report frozen OSV findings without failing the advisory check - #880

Scope

• When the frozen OSV scan completes with findings (native exit 1), its advisory check currently fails on unrelated PRs. This change reports those findings successfully while keeping scanner and report errors failing.
• Base commit: 89e89852161d8157e464f4bd07c2b5c747ad4706
• Lane: lane:foundation
• Owned paths touched: frozen report workflow, its existing recording-double test, dated decision, measurement receipt and their evidence registrations.

SOTA sources

• google/osv-scanner v2.6.0: native findings return 1; operational failures return 127–130. The workflow preserves both raw codes and normalizes only completed-report findings.
• GitHub shell and step semantics and job conditions: explicit exit handling and unchanged always/trusted-event guards.
• PR #845, its dated frozen-report design and native baseline run 37821865072: nine retained advisories, JSON/SARIF exits 1/1, no operational error.

Evidence-class table

Local commands run

python3 -m unittest tests.test_frozen_evidence_reporting tests.test_osv_lockfile_coverage tests.test_frozen_macos_variant_no_use tests.test_workflow_hardening tests.test_workflow_policy tests.test_workflow_security_coverage -q
# 254 tests, rc 0, one existing skip; before the final vendor-code test extension
python3 -m unittest tests.test_frozen_evidence_reporting.FrozenReportWorkflowTests.test_native_findings_errors_and_both_logs_are_retained -v
# final 128/129 extension: rc 0
actionlint .github/workflows/frozen-evidence-risk.yml
# rc 0
python3 scripts/validate.py
# rc 0: 70 components, 10878 hashed files, 4 profiles, 235 receipts
git apply --check <owned inverse patch>
# inverse and forward round trip passed; base/candidate file hashes matched

Decision record

docs/decisions/2026-10-08-frozen-risk-report-result.md and
evidence/artifacts/github-ci-opt6-report-status-20261008.json.

Intentional kind 3 contract change: only
FrozenReportWorkflowTests.test_native_findings_errors_and_both_logs_are_retained.
Running all 13 unchanged base reporting methods on this candidate produces
exactly its two declared finding-only subtest failures, JSON1/SARIF0 and
JSON0/SARIF1; zero errors. Its original invocation/code/log assertions remain.

Host evidence

No new host receipt or status flip. The actual hosted before artifact is retained
separately from synthetic after controls. The archived input, empty report config,
ordinary required scan, raw serialization, artifact retention and trusted write
guards keep their existing bytes/contracts.

Checklist

• Action pins and version comments preserved.
• Empty default permissions and existing least-privilege job grants preserved.
• No credential values, new required secret, provider or billing surface.
• Peer work preserved; isolated owned worktree.
• Inverse tested and receipt retained.
• Native hosted after recorded.
• Explicit CC workflow landing cue through 5f.

Revert this change through a reviewed inverse PR; findings stay visible in native
JSON/SARIF/logs and review alerts. Scanner errors and unavailable/malformed reports
remain failures. This PR remains draft while exact-head review and hosted checks finish.