CI & Automation

Emit SARIF from a Shipmoor scan, upload it into GitHub code scanning, and handle the exit-code contract (exit 1 means the gate fired, not an error) so findings still reach the Security tab.

Authorize Shipmoor Scan with SHIPMOOR_TOKEN, run the local Scan in GitHub Actions, and optionally upload SARIF to code scanning.

Run the currently supported self-managed Shipmoor CI flow: local Scan with a scan-scoped SHIPMOOR_TOKEN and optional SARIF upload.