docs(931): name the host that can pass the SAST gate and the script's own exit 2

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: f9ce6bc6-5b36-491a-8d72-89c1f70dd3e1

docs/ci-cd.md

@@ -2667,7 +2667,7 @@ running product from outside our C#/review stack.
   registry unreachable) also fails the script, since findings alone exit 0. `--selftest` pins the
   missing, opted-out, present and failing cases through the script's own exit status (ersatztv#931). A non-interactive ssh shell needs semgrep on
   its `PATH` (`~/.zshenv`, not `.zshrc`).
-- **Where/when.** Runs on a **docker host** with registry access (bumblebee, as the script's own header names, or jazz), like
+- **Where/when.** Runs on a **docker host** with registry access (bumblebee, which has semgrep on its non-interactive `PATH`; a host without semgrep fails the gate, so jazz needs it installed first), like
   `migration-smoke.sh`: `scripts/security-scan.sh [IMAGE] [PORT]` (defaults `…:latest` / `8411`). It is a
   **manual release-gate**, deliberately **not** a per-PR CI job — it needs docker + a booted image, takes
   several minutes, and is noisy (expect to tune, not take raw). The continuous layer is the per-PR
@@ -2686,6 +2686,8 @@ running product from outside our C#/review stack.
   `FAIL-NEW: 0` and two known/expected warning classes — the shell result looked like a failure though the
   release gate had actually passed. Run `scripts/security-scan.sh --selftest` for a docker-free regression
   check of the classification logic.
+  **The script's own exit 2 is not ZAP's WARN**: it means the SAST half did not run (semgrep missing
+  before the scan, or present and erroring after it) and is release-blocking.
 - **Triage.** Triage each WARN/FAIL finding false-positive vs real. Real, in-scope, go-live-blocking
   findings get fixed (e.g. the security headers from the #319 baseline; the Microsoft.OpenApi pin above);
   LAN-expected noise (Private-IP disclosure) is revisited only for genuine remote exposure. nuclei

scripts/security-scan.sh

@@ -33,6 +33,8 @@
 #   other the scanner/tool itself errored (bad args, crash) — not a scan result at all
 # classify_zap_exit() (below) is the single place this contract is encoded; the script's own final exit
 # code reflects the CLASSIFICATION (0 for clean/WARN, 1 for FAIL/timeout/tool-error), not ZAP's raw code.
+# The one script-level exit 2 is NOT ZAP's WARN: it means the SAST half did not run (semgrep missing, or
+# present and erroring) and IS release-blocking.
 
 set -euo pipefail