fix(scan): setup/fetch exit 2; reject VERSION/tag_name that leaves the download path

[sheel-PBM]

Summary

Setup/fetch failures exit 2. That includes an unresolved VERSION, unsupported OS/arch, and a VERSION or /releases/latest tag_name that is not a single path segment (it would rewrite /releases/download/${VER}/${ASSET} and the local -o path). Not #3 (native remap after a run). Not #7 (checksum stays exit 1).

docs/EVALUATION.md treats exit 1 as a gate result and exit 2 as a scanner/I/O failure. Failing to resolve VERSION currently exits 1, so a pipeline cannot tell a dead GitHub lookup from a repo that has findings.

This remaps pre-scan setup failures that #3 does not cover (#3 remaps the native trustabl exit after a run):

Setup failure	Wrapper exit
Could not resolve VERSION	2 (was 1)
Unsupported OS / arch	2 (was 1)
VERSION / tag_name with /, .., whitespace, :, or @	2 (was: interpolated into the download URL and -o path)

A pin or a /releases/latest tag_name that is not a single path segment would change /releases/download/${VER}/${ASSET} and the local tarball filename. Checksum mismatch stays at exit 1 so this does not collide with the fail-closed / macOS checksum PRs (#7, #9, #12, #55).

Test plan

• bash -n scan/trustabl-scan.sh
• shellcheck -S error on *.sh
• bash test/test-setup-exit.sh (stubbed curl, no network: unresolved VERSION, slash pin, and slash tag_name all exit 2; no binary fetch)
• Pin a real VERSION: findings still exit 0/1 as before

[sheel-PBM]

@sairenchristianbuerano @trustabl Ready for review. Distinct from #3 (this remaps pre-scan setup failures; #3 remaps the native binary). Local bash -n, shellcheck -S error, and test/test-setup-exit.sh pass.

Lint is action_required on the first-time fork workflow (run 32799882278) — not a lint failure. Approving that run unblocks the check.