ci(security-scan): remove deprecated OSV flags and SARIF checkout-path warnings

[seonghobae]

Fresh consumer evidence

Wardnet PR ContextualWisdomLab/wardnet#129 exact head 2cedf7098723cd12f59125e72f4354226165a112 exercised the organization-required central Security Scan run 34712023584, osv-scan job 103602430968 on 2026-09-12 UTC. The job is terminal SUCCESS with zero OSV findings, but the live required workflow emits warnings that must not be normalized as acceptable noise:

1. google/osv-scanner-action reports Warning: --output has been deprecated in favor of --output-file for both base/head scans.
2. osv-reporter reports Warning: --output has been deprecated in favor of --output-files.
3. github/codeql-action/upload-sarif is given checkout_path: /home/runner/work/wardnet/wardnet while the exact repository checkout lives at /home/runner/work/wardnet/wardnet/source; it therefore logs twice that the checkout path does not appear to be a git repository and falls back to caller-supplied/server-derived commit identity.

The same log proves the exact-base and exact-head checkouts themselves are correct (f8260f1e... and 2cedf709...) and both OSV result sets contain 0 findings, so this is a central reusable-workflow/runtime-quality defect rather than a Wardnet product-source vulnerability.

Ownership boundary

.github owns the reusable security-scan.yml integration. Do not patch consumer repositories, suppress stderr/warning text, weaken OSV/SARIF gates, replace immutable action pins with floating refs, or treat successful completion as resolution of deprecation/provenance warnings.

This is distinct from the delegated CodeQL settlement stack in #1929/#2040/#2106: the producer/handler cycle may coexist with these warnings, but neither should mask the other.

RED → GREEN acceptance

• Add/adjust central executable workflow-contract fixtures so current OSV CLI flags use the non-deprecated output options supported by the pinned OSV action/runtime.
• Bind upload-sarif's checkout_path to the actual exact target-repository checkout directory (currently source) or otherwise make the Git working tree identity explicit without changing the bound ref/sha semantics.
• Preserve exact immutable base/head identity, --no-resolve, fail-on-vulnerability semantics, comprehensive clean SARIF behavior, immutable action pins, least privilege, artifact/debug evidence, and existing security thresholds.
• Exact-head canary must complete with zero occurrences of the three warnings above while a clean scan still produces authoritative SARIF for the exact PR head.
• Add a negative fixture proving a wrong/non-repository checkout path fails the central contract instead of silently relying on fallback derivation.
• Consumer repositories require no source change; verify on an unchanged Wardnet or equivalent exact-head canary after protected central integration.

Do not close as a documentation-only cleanup: this issue owns the executable warning/root-cause repair in the central security-scan workflow.

[seonghobae]

Fresh Wardnet consumer evidence after ordinary #384 integration: ContextualWisdomLab/wardnet#129@6fe35a1d5d46ea2fcac6d86d94504577007992c8, Security Scan run 34725218913, OSV job 103638087939 is terminal SUCCESS with 0 base and 0 head findings, but still emits both central reusable-workflow warnings:

1. Warning: --output has been deprecated in favor of --output-file during base/head osv-scanner-action invocations (--output=old-results.json, --output=new-results.json).
2. Warning: --output has been deprecated in favor of --output-files during osv-reporter-action (--output=results.sarif).
3. SARIF upload still logs The checkout path provided to the action does not appear to be a git repository because checkout_path resolves to /home/runner/work/wardnet/wardnet while the exact checked-out repository is /home/runner/work/wardnet/wardnet/source.

This is consumer evidence only; Wardnet will not copy or override the central workflow. RED→GREEN acceptance remains: use the non-deprecated OSV output flags supported by the pinned action, point SARIF attribution at the actual source checkout (or remove the mismatched override if the central action can derive it correctly), then prove on an unchanged exact consumer head that the Security Scan stays GREEN with 0 introduced findings and neither deprecation warnings nor checkout-path warnings appear.