fix(scan): check for required commands before scanning

[joeymussalli]

Nothing guarantees the script's dependencies are present when it runs. The CodePipeline buildspec tries to install jq and curl like this:

• command -v jq >/dev/null 2>&1 || { yum -y install jq || (apt-get ...); } >/dev/null 2>&1 || true

which discards the output and ends in || true, so an install that fails -- unsupported base image, no network, no package manager, not root -- leaves the build going with the tool missing and nothing said about it. The CodeCatalyst workflow attempts no install at all; it just runs the script.

The failure that follows is misattributed. With jq absent, the guard that validates trustabl.json cannot parse it and the run fails with "no usable trustabl.json -- results cannot be trusted", pointing the user at the scan result when the real problem is the build image. Worse is grep or head going missing: the checksum lookup quietly yields an empty EXPECTED, the script prints "not listed in checksums.txt -- skipping verification", and the release binary runs unverified.

• Check curl, jq, tar, awk, grep, head and uname up front; on failure name every missing command at once and exit 2, the code docs/EVALUATION.md already documents as "scanner or I/O error ... the output should not be trusted".
• git is deliberately excluded. Every call is inside a guard, and without it the script degrades to BR=unknown and REPO=$TARGET rather than breaking, so requiring it would reject build images that work fine today.
• tr and seq are excluded because they ship in coreutils alongside head, which is checked.

Left the buildspec's || true alone on purpose. That fallback only matters when the tool is genuinely absent and the install genuinely failed, and in that case the preflight's message is more useful than a raw package-manager error would be. Removing it would trade a clear diagnosis for a noisier one.

Verified against a sandboxed PATH: silent and exit 0 with everything present; exit 2 naming exactly the missing tools for one, two and three of them removed; and still exit 0 with git removed, confirming it stays optional.