fix(ci): scan-and-report — skip verisimdb dispatch when VERISIMDB_PAT is absent (#156)

## Summary
`VERISIMDB_PAT` is declared **optional** in `scan-and-report.yml`, but
consumers without it fall back to `GITHUB_TOKEN` — which is scoped to
the calling repo and can never fire a `repository_dispatch` at
`verisimdb-data`. Result: every consumer without the PAT gets a red
Security Scan at the dispatch step (bare `curl` exit 22), even though
the scan itself passed. Seen on echidna run 28842498410 immediately
after #155 removed the argv overflow that had been masking it.

- **No PAT** → `::notice` + skip the dispatch step; the scan result
still gates the job.
- **With PAT** → capture `%{http_code}` and print the API response body
on rejection, so a real dispatch failure is diagnosable.

## Verification
- `actionlint` clean.
- Skip path exercised locally (empty `DISPATCH_TOKEN` → notice + exit
0).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/scan-and-report.yml

@@ -44,8 +44,17 @@ jobs:
       - name: Send to verisimdb-data
         if: steps.scan.outputs.scan_complete == 'true'
         env:
-          DISPATCH_TOKEN: ${{ secrets.VERISIMDB_PAT || secrets.GITHUB_TOKEN }}
+          DISPATCH_TOKEN: ${{ secrets.VERISIMDB_PAT }}
         run: |
+          # VERISIMDB_PAT is declared optional. Cross-repo dispatch is
+          # impossible with the workflow's own GITHUB_TOKEN (it is scoped
+          # to the calling repo), so without the PAT we skip rather than
+          # fail every consumer's Security Scan.
+          if [ -z "${DISPATCH_TOKEN}" ]; then
+            echo "::notice::VERISIMDB_PAT not configured; scan passed, skipping cross-repo dispatch to verisimdb-data"
+            exit 0
+          fi
+
           REPO_NAME=$(basename $(pwd))
 
           # Build the payload in a file: inlining the scan JSON on argv
@@ -73,9 +82,15 @@ jobs:
                }}}' scan-result.json > dispatch-payload.json
           fi
 
-          curl -sf -X POST \
+          # Capture the HTTP status so a rejected dispatch says *why*
+          # instead of a bare curl exit 22.
+          HTTP_STATUS=$(curl -s -o dispatch-response.json -w "%{http_code}" -X POST \
             -H "Authorization: Bearer ${DISPATCH_TOKEN}" \
             -H "Accept: application/vnd.github+json" \
             "https://api.github.com/repos/hyperpolymath/verisimdb-data/dispatches" \
-            --data @dispatch-payload.json
-          echo "Dispatched scan results for ${REPO_NAME} to verisimdb-data"
+            --data @dispatch-payload.json)
+          if [ "${HTTP_STATUS}" -ge 300 ]; then
+            echo "::error::verisimdb-data dispatch failed with HTTP ${HTTP_STATUS}: $(cat dispatch-response.json)"
+            exit 1
+          fi
+          echo "Dispatched scan results for ${REPO_NAME} to verisimdb-data (HTTP ${HTTP_STATUS})"