fix(ci): the Kubescape guard does not count a scan with an interleaved flag or no framework list #4379

🤖 Generated by the Agentic Engineer

Found while working on #3585.

Evidence

Each line below sits in a second run: step beside the real ksail workload scan --framework nsa,mitre --compliance-threshold 95 step. The guard on main (9da24196) accepts every one and reports nsa,mitre, while the line runs a scan of nsa alone that can overwrite the uploaded SARIF.

U1 relies on Cobra's stripFlags (reviewed in source). U2 relies on the --framework default of nsa declared by ksail workload scan.

Audience and problem

Same gate as #2823 and #3338: the guard must count every scan that runs, because a reduced scan beside the full one can replace the SARIF that Code Scanning keeps.

Direction

• U1: find the subcommand the way Cobra does, skipping flag words between ksail, workload and scan, or refuse any ksail line whose subcommand words are not adjacent.
• U2: count an unframed ksail workload scan as an invocation. The step then holds two scans and is refused, and an unframed scan on its own is refused as reading no framework list.

Acceptance criteria

• U1 (each root flag) and U2 are refused, each by a test that fails on main.
• Controls stay accepted: the real workflows, and ksail --version / ksail workload validate steps beside the scan.
• Every existing test passes unmodified.