fix: gracefully skip security scan when build artifact is absent

When docker-build.yml skips the build for renovate/chore PRs, no
docker image artifact is uploaded. Previously, security-pr.yml would
crash with reason_category=not_found when the artifact was missing,
treating an intentional skip as a hard failure.

The fix distinguishes "artifact not found" from API errors: missing
artifacts now set artifact_exists=false and exit cleanly. The download
and image-load steps are guarded by this output, so the entire artifact
path is skipped gracefully. Downstream scan steps were already gated
on artifact_exists==true, so no further changes are needed.

Renovate dependency PRs will now produce a passing (no-op) security
scan job rather than a failed one.

Author: actions-user

.github/workflows/security-pr.yml

@@ -226,11 +226,12 @@ jobs:
           ARTIFACT_ID=$(printf '%s' "${ARTIFACTS_JSON}" | jq -r --arg name "${ARTIFACT_NAME}" '.artifacts[] | select(.name == $name) | .id' | head -n 1)
 
           if [[ -z "${ARTIFACT_ID}" ]]; then
-            echo "❌ reason_category=not_found"
-            echo "reason=Required artifact was not found"
+            echo "⚠️ reason_category=not_found"
+            echo "reason=Artifact not found — build was likely skipped (e.g., renovate/chore PR)"
             echo "upstream_run_id=${RUN_ID}"
             echo "artifact_name=${ARTIFACT_NAME}"
-            exit 1
+            echo "artifact_exists=false" >> "$GITHUB_OUTPUT"
+            exit 0
           fi
 
           {
@@ -241,7 +242,7 @@ jobs:
           echo "✅ Found artifact: ${ARTIFACT_NAME} (ID: ${ARTIFACT_ID})"
 
       - name: Download PR image artifact
-        if: github.event_name == 'workflow_run' || github.event_name == 'workflow_dispatch'
+        if: (github.event_name == 'workflow_run' || github.event_name == 'workflow_dispatch') && steps.check-artifact.outputs.artifact_exists == 'true'
         # actions/download-artifact v4.1.8
         uses: actions/download-artifact@484a0b528fb4d7bd804637ccb632e47a0e638317
         with:
@@ -250,7 +251,7 @@ jobs:
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Load Docker image
-        if: github.event_name == 'workflow_run' || github.event_name == 'workflow_dispatch'
+        if: (github.event_name == 'workflow_run' || github.event_name == 'workflow_dispatch') && steps.check-artifact.outputs.artifact_exists == 'true'
         id: load-image
         run: |
           echo "📦 Loading Docker image..."