fix(cli): clean operational-failure handling — exit 3, no stack trace

End-user verification of the v0.7.0 binaries surfaced it: a transient
registry failure (after the resilience pipeline gave up) blew an unhandled
HttpRequestException stack trace at the user. A dead registry is an
OPERATIONAL failure, not a policy verdict:

- New ExitCodes.Unavailable = 3, distinct from PolicyViolation(1)/Usage(2),
  so CI can retry instead of failing the gate.
- Program.cs wraps the dispatch: HttpRequestException/TaskCanceled/Timeout
  -> one clean stderr line + exit 3; Ctrl-C -> "Cancelled." + exit 3.

Verified live: HTTPS_PROXY to a dead endpoint yields
"error: an external service is unreachable — Connection refused" and exit 3.

Tool 0.7.1.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: AdrianDeutsch

action.yml

@@ -46,7 +46,7 @@ inputs:
   tool-version:
     description: 'The DepRadar.Tool version to install.'
     required: false
-    default: '0.7.0'
+    default: '0.7.1'
   tool-source:
     description: 'Extra NuGet source for the tool (e.g. a locally-packed nupkg directory). Defaults to NuGet.org.'
     required: false

src/DepRadar.Cli/DepRadar.Cli.csproj

@@ -18,7 +18,7 @@
     <SelfContained Condition="'$(StandaloneBinary)' == 'true'">true</SelfContained>
     <EnableCompressionInSingleFile Condition="'$(StandaloneBinary)' == 'true'">true</EnableCompressionInSingleFile>
     <PackageId>DepRadar.Tool</PackageId>
-    <Version>0.7.0</Version>
+    <Version>0.7.1</Version>
     <Authors>Adrian Deutsch</Authors>
     <Description>Dependency-health CLI: scan a NuGet package or project for security, license and maintenance risk, fail CI on policy violations, and auto-fix vulnerable dependencies (incl. transitive) with a pull request.</Description>
     <PackageOutputPath>$(MSBuildThisFileDirectory)../../artifacts/nupkg</PackageOutputPath>

src/DepRadar.Cli/ExitCodes.cs

@@ -14,4 +14,11 @@ internal static class ExitCodes
 
     /// <summary>Bad usage, or nothing could be resolved.</summary>
     public const int Usage = 2;
+
+    /// <summary>
+    /// An external service was unreachable (registry/OSV down, network cut) after the
+    /// resilience pipeline gave up. Distinct from <see cref="PolicyViolation"/> so CI
+    /// can retry instead of failing the gate.
+    /// </summary>
+    public const int Unavailable = 3;
 }

src/DepRadar.Cli/Program.cs

@@ -1,7 +1,6 @@
 using DepRadar.Cli;
 
 // CI-friendly entry point: dispatch the verb and return a process exit code.
-// `depradar scan <target>` is the only verb today; --help prints usage.
 using var cts = new CancellationTokenSource();
 Console.CancelKeyPress += (_, e) =>
 {
@@ -15,17 +14,34 @@
     return args.Length == 0 ? ExitCodes.Usage : ExitCodes.Ok;
 }
 
-return args[0] switch
+// A dead registry/OSV after the resilience pipeline gave up is an OPERATIONAL failure,
+// not a policy verdict — report it cleanly (no stack trace) with its own exit code so
+// CI can retry instead of failing the gate.
+try
 {
-    "scan" => await ScanCommand.RunAsync(args[1..], cts.Token),
-    "diff" => await DiffCommand.RunAsync(args[1..], cts.Token),
-    "fix" => await FixCommand.RunAsync(args[1..], cts.Token),
-    "npm" => await NpmCommand.RunAsync(args[1..], cts.Token),
-    "pypi" => await PyPiCommand.RunAsync(args[1..], cts.Token),
-    "cargo" => await CargoCommand.RunAsync(args[1..], cts.Token),
-    "go" => await GoCommand.RunAsync(args[1..], cts.Token),
-    var unknown => Fail(unknown),
-};
+    return args[0] switch
+    {
+        "scan" => await ScanCommand.RunAsync(args[1..], cts.Token),
+        "diff" => await DiffCommand.RunAsync(args[1..], cts.Token),
+        "fix" => await FixCommand.RunAsync(args[1..], cts.Token),
+        "npm" => await NpmCommand.RunAsync(args[1..], cts.Token),
+        "pypi" => await PyPiCommand.RunAsync(args[1..], cts.Token),
+        "cargo" => await CargoCommand.RunAsync(args[1..], cts.Token),
+        "go" => await GoCommand.RunAsync(args[1..], cts.Token),
+        var unknown => Fail(unknown),
+    };
+}
+catch (OperationCanceledException) when (cts.IsCancellationRequested)
+{
+    Console.Error.WriteLine("Cancelled.");
+    return ExitCodes.Unavailable;
+}
+catch (Exception exception) when (exception is HttpRequestException or TaskCanceledException or TimeoutException)
+{
+    Console.Error.WriteLine($"error: an external service is unreachable — {exception.Message}");
+    Console.Error.WriteLine("Check your network (or the registry/OSV status) and try again.");
+    return ExitCodes.Unavailable;
+}
 
 static int Fail(string verb)
 {