fix(cli): require verification for no-change patches - #1020

Summary

scan --patch could return success after the model reported no_change without explaining how it verified the finding. That result now becomes failed with exit code 2, matching the existing check for verified results.

Fixes #1019. Original fix by @arunimshukla.

Changes

• Apply the existing nonblank verification check to both successful statuses.
• Ask for verification in the model's response format for both statuses.
• Extend the existing tests for missing and whitespace-only verification, and preserve valid no_change, blocked, and failed behavior.

Testing

• Focused patch tests: 72 passed with seed 12345 and the existing 30-second timeout.
• Controlled before/after comparison: the same tests fail twice on current main because missing and blank no_change verification return success. All eight selected cases pass with this fix. These tests supply model responses explicitly.
• Built CLI scan with a real model on a benign local fixture: completed successfully, with complete coverage, no findings, and no source changes. This checks scan compatibility; it did not exercise the missing-verification case.
• Plugin build, CI-script build, SDK build, type checks, and formatting passed.

Risk and rollout

This checks whether a verification explanation is present. It cannot establish whether that explanation is true. Valid no_change results remain accepted; missing or blank verification now fails. No CLI options or output fields change.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.