docs(931): a failing setup command's exit is its own status, and the Hosts row names no excluded host

The exit list gave "any other code" to a set -e setup failure, but `docker pull`
usually exits 1, which collides with the ZAP FAIL code; it now says such a
failure exits with that command's own status. The jazz Hosts row said the scan
runs "not [on] this one", which would stay wrong once jazz gets semgrep; it now
says any docker host that meets the requirements.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: f9ce6bc6-5b36-491a-8d72-89c1f70dd3e1

docs/ci-cd.md

@@ -9,7 +9,7 @@ server-management#481.
 
 | Host | IP | Role |
 |---|---|---|
-| **jazz** | 192.168.1.29 | **Docker host for the media transcoders** — prod `ersatztv` (8409), `ersatztv-test` (8410), Jellyfin. The prod-copy `migration-smoke.sh` runs here. The release scan (`security-scan.sh`) boots its own throwaway target, so it needs a docker host that meets its requirements (Security scanning → Where/when), not this one. |
+| **jazz** | 192.168.1.29 | **Docker host for the media transcoders** — prod `ersatztv` (8409), `ersatztv-test` (8410), Jellyfin. The prod-copy `migration-smoke.sh` runs here. The release scan (`security-scan.sh`) boots its own throwaway target from the registry, so it runs on any docker host that meets its requirements (Security scanning → Where/when). |
 | **bumblebee** | 192.168.1.99 | CI runners (`bumblebee-runner`, `small-runner`), plus every other Docker stack. All the memory/lane measurements below were taken here. |
 | **ci-runner** | VM 127 (pve4) | The other `ubuntu-latest` CI runner. |
 
@@ -2682,7 +2682,7 @@ running product from outside our C#/review stack.
   tool error, or the throwaway target never came up or its key was unreadable; **2** — *not* ZAP's WARN —
   a scanner half did not run: semgrep missing (before the scan) or erroring (after it), or docker
   missing; if ZAP already classified non-zero, that status stands and the semgrep error prints beside
-  it; **any other** code is a setup command (e.g. `docker pull`) failing under `set -e`. Run
+  it. A setup command that fails under `set -e` (e.g. `docker pull`) exits with its own status. Run
   `scripts/security-scan.sh --selftest` for a docker-free regression check: it pins every ZAP
   classification, and runs the script itself with shimmed tools (ZAP reporting clean) to pin the
   semgrep gate — missing → exit 2 before docker is checked, erroring → 2, succeeding → 0 with semgrep

scripts/security-scan.sh

@@ -39,7 +39,7 @@
 #   2     NOT ZAP's WARN: a scanner half did not run — semgrep missing (checked before the scan) or erroring
 #         (after it), or docker missing. If ZAP already classified non-zero, that status stands and the
 #         semgrep error is printed alongside it.
-#   other a setup command failed under `set -e` (e.g. `docker pull`), exiting with that command's status
+# A setup command that fails under `set -e` (e.g. `docker pull`) exits with that command's own status.
 
 set -euo pipefail