fix(workspace): prevent Maven discovery from blocking fallthrough to other ecosystems

Two fixes:
1. discoverWorkspaceManifests now checks if Maven module discovery found
   actual submodules (size > 1) before returning. A single-module Maven
   project (just root pom.xml) falls through to Gradle/Go/uv/JS detection.
2. resolveMavenBinary now verifies the wrapper is accessible (runs it
   with -v) before returning it, matching selectMvnRuntime behavior.
   Also uses Operations.getExecutable instead of getCustomPathOrElse to
   verify the system Maven binary exists.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: Strum355

src/main/java/io/github/guacsec/trustifyda/impl/ExhortApi.java

@@ -880,7 +880,10 @@ List<Path> discoverWorkspaceManifests(Path workspaceDir, Set<String> ignorePatte
     // Maven multi-module: pom.xml
     Path pomXml = workspaceDir.resolve("pom.xml");
     if (Files.isRegularFile(pomXml)) {
-      return discoverMavenModules(workspaceDir, ignorePatterns);
+      List<Path> mavenManifests = discoverMavenModules(workspaceDir, ignorePatterns);
+      if (mavenManifests.size() > 1) {
+        return mavenManifests;
+      }
     }
 
     // JS workspace: require package.json + a lock file
@@ -1076,10 +1079,15 @@ private String resolveMavenBinary(Path startDir) {
         String mvnw =
             JavaMavenProvider.traverseForMvnw(wrapperName, startDir.resolve("pom.xml").toString());
         if (mvnw != null) {
-          return mvnw;
+          try {
+            Operations.runProcess(startDir, mvnw, "-v");
+            return mvnw;
+          } catch (Exception e) {
+            LOG.warning("Maven wrapper found but not accessible: " + e.getMessage());
+          }
         }
       }
-      return Operations.getCustomPathOrElse(mvn);
+      return Operations.getExecutable(mvn, "-v");
     } catch (Exception e) {
       LOG.warning("Failed to resolve Maven binary: " + e.getMessage());
       return null;