Fail report-only JSON when detail queries fail

A report-only `scan --json` (`--prune` with no mode) with a severity
floor or `enabled: false` fetches patch details to fill
`policy.filtered[]`. If every query failed it still printed a success
envelope and exited 0. It now reports the error and exits 1, like the
agent and vendored runs.

Human-mode policy warnings now print `Warning: <detail>` like the rest
of `scan`; the code stays in the JSON `warnings[]` entry.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BKsyzefGhAnPkYmXCwq3H3

Author: claude

crates/socket-patch-cli/src/commands/scan/mod.rs

@@ -2057,7 +2057,7 @@ async fn run_scan(
         // `enabled: false` still hides candidates; report them like the
         // human arm does (the detail fetch runs only then).
         if !apply && !vendor && policy.reports_selection() && !all_packages_with_patches.is_empty() {
-            let _ = discover_selected(
+            if let Err((code, message)) = discover_selected(
                 &api_client,
                 &all_packages_with_patches,
                 can_access_paid_patches,
@@ -2067,7 +2067,11 @@ async fn run_scan(
                 telemetry,
                 Some(&mut result),
             )
-            .await;
+            .await
+            {
+                emit_discovery_error_json(&mut result, &message);
+                return code;
+            }
         }
 
         // --- Apply path (if requested) -----------------------------------

crates/socket-patch-cli/src/commands/scan/policy.rs

@@ -480,7 +480,7 @@ impl ScanPolicy {
             return;
         }
         for w in &self.warnings {
-            eprintln!("Warning ({}): {}", w.code, w.detail);
+            eprintln!("Warning: {}", w.detail);
         }
     }
 

crates/socket-patch-cli/tests/e2e_socket_yml_policy.rs

@@ -684,6 +684,30 @@ async fn enabled_false_reports_and_writes_nothing() {
     assert_eq!(doc["redirect"]["redirected"], 0);
 }
 
+#[tokio::test]
+#[serial]
+async fn report_only_json_fails_when_every_detail_query_fails() {
+    let server = MockServer::start().await;
+    Mock::given(method("GET"))
+        .and(path_regex(format!("^/v0/orgs/{ORG}/patches/by-package/.+$")))
+        .respond_with(ResponseTemplate::new(500))
+        .with_priority(1)
+        .mount(&server)
+        .await;
+    mount_api(&server, catalog()).await;
+    // `--prune` with no mode is the report-only arm.
+    let repo = Repo::new(Some("version: 2\npatches:\n  minSeverity: critical\n"));
+    let before = repo.snapshot();
+    let (code, doc) = scan_json(&repo.dir("services/web"), &server.uri(), &["--prune"], &[]);
+    assert_eq!(code, 1, "{doc:#}");
+    assert_eq!(doc["status"], "error", "{doc:#}");
+    assert!(
+        doc["error"].as_str().unwrap_or_default().contains("patch-detail queries failed"),
+        "{doc:#}"
+    );
+    assert_eq!(repo.snapshot(), before);
+}
+
 #[tokio::test]
 #[serial]
 async fn recorded_merged_patch_below_a_new_floor_is_kept() {