Record the K-6c8197 sweep decision: no failing test suite at trigger head 24498404a1, blockers are environmental #284

Survey for kanban item K-6c8197 "Sweep the tests (run_9044d315)" on vulnetix/cli. This is the only handoff; it covers every clause of the request.

The survey is done and found no test failures attributable to the code at the trigger head 2449840 (push event for this card). Evidence:

• The trigger head is a [skip ci] commit: message "chore: update flake.nix to v3.153.0 [skip ci]" by github-actions[bot], dated 2026-11-02, changing only flake.nix. Its GitHub commit page shows no status summary and no workflow runs; the /checks page lists only CodeQL. The [skip ci] marker comes from the repo's own release.yml (line 373: git commit -m "chore: update flake.nix to v${VER_NUM} [skip ci]"), so the repo intends no CI on these commits.
• The repo's detected check go test ./... was run at the worktree commit 6783d8c. Every failure is environmental, none is a code failure:
  • Packages github.com/vulnetix/cli/v3 (module), /cmd, /internal/agent, /internal/aibom, /internal/analyze, /internal/bom, /internal/cbom, /internal/cdx, /internal/defences, /internal/display, /internal/fix, /internal/ghactx, /internal/ghasetup, /internal/ghtasks, /internal/license, /internal/lsp, /internal/pipeline, /internal/reachability, /internal/report, /internal/sast, /internal/scan, /internal/scanopts, /internal/scaview, /internal/testsuite, /internal/triage, /internal/tui, /internal/upload, /internal/vex, /pkg/vdb, /tools/sasteff: all "[setup failed]" because the private deps github.com/Vulnetix/vdb-sca-match and github.com/Vulnetix/vdb-manifest cannot be fetched (proxy returns 404, git fetch needs credentials that are not in the sandbox; .github/workflows/test.yml lines 34-38 show the CI job itself needs secrets.PACKAGES_TOKEN to fetch them).
  • internal/gitctx TestGitStatusDirtyAgreesWithGoGit, internal/gitopen TestOpenReadsHistoryInAWorktree and TestOpenDetectParentsOnlyWhenAsked, internal/secretscan TestScanGitHistory_ShallowCloneAndItsWorktree: fail because the sandbox filesystem is read-only ("could not lock config file ... Read-only file system"), so git init inside the tests cannot write; not a code failure.
• The other ~100 packages in the suite passed (ok), including the whole internal/sensor tree, pkg/*, internal/attest, internal/config, internal/lsp/protocol, internal/cdxsign, internal/purl.
• No open cli tests-failing card exists on the board (the open vulnetix/cli cards are the sibling sweep K-878420, blocked repro/lint cards, and done items); nothing to dedup against.

What is NOT to be done: do not file a tests-failing card for the setup failures (they are a credentials/sandbox environment blocker, already understood from test.yml's PACKAGES_TOKEN setup), and do not file one for the read-only-filesystem failures (sandbox artifact). No code change is requested by this card ("Do not fix anything in this step"), so the only action is confirming no failing suite exists and closing the survey.

Clauses covered: C1 (the detected suite was run; every failure is environmental, none is a suite failure), C2 (no failing suite found, so no tests-failing card is warranted; the board has none open), C3 (nothing was fixed).

_{Synced from Belai card K-33fe93 on Vulnetix. Edit here or on the board; both update.}