[ci-scan] Add Hard Rule 10 for early exit on no scannable build (#7654)

* ci-scan: add Hard Rule 10 for explicit early exit on no scannable build

95 consecutive ci-scan runs have skipped at Step 1 selection time
(stale build window >14d) while consuming 350-470K effective tokens on
the build-list fetch, instruction read, and reasoning. The 'and stop'
sentence in Step 1 was a prose instruction; Hard Rule 10 elevates the
no-scannable-build exit to the same level as the issue-cap and label
rules — an inviolable invariant.

When Step 1 determines no scannable build exists, the scanner must:
- append the outcome line to MachineLearning-CI.txt
- print | 0 | 0 | 0 | 1 | as the Step 7 tally (honest: 1 skipped)
- emit noop and stop immediately
- NOT fetch AzDO timeline, task logs, or Helix work items

Updates Step 1's trailing sentence to reference Hard Rule 10 directly.

Triggering signal: 14 prior ci-scan-feedback runs proposed this edit;
git push failed each time, producing misfiled fallback issues #7627,
#7630, #7636, #7637, #7639, #7640, #7641, #7642, #7643, #7644, #7645,
#7646, #7648, #7650.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Address review: use documented coverage-line format and print full Step 7 table

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Trigger report-green pipeline

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: 3 people

.github/workflows/ci-scan.agent.md

@@ -78,6 +78,7 @@ These invariants are not delegated to the shared file. Honor them even if a shar
 7. **All state under `/tmp/gh-aw/agent/`;** each bash call is a fresh subshell.
 8. **AzDO REST is anonymous;** stay on `https://dev.azure.com/dnceng-public/public/_apis/build/...`. Follow every rule in [Environment constraints](shared/ci-scan.instructions.md#environment-constraints) (pre-bind URLs, `%24top`, no redirection).
 9. **Sanitize every embedded log excerpt** per [Sanitization](shared/ci-scan.instructions.md#sanitization).
+10. **Exit immediately on empty build window.** When Step 1 determines no scannable build exists, immediately append one Step 7 coverage line to `/tmp/gh-aw/agent/coverage/MachineLearning-CI.txt` in the documented `<sig-short>  <outcome>  <reason-if-skipped>` format as `-  skipped: <reason>`, print the full Step 7 summary table (the `| total-signatures | issues-filed | reused-existing | skipped-with-reason |` header followed by the `| 0 | 0 | 0 | 1 |` row), emit `noop` with the skip reason, and stop. Do not fetch the AzDO timeline, download task logs, query Helix work items, or execute any step beyond Step 1.
 
 ## Step 1 - Select the source build
 
@@ -88,7 +89,7 @@ url='https://dev.azure.com/dnceng-public/public/_apis/build/builds?definitions=1
 curl -s "$url" | tee /tmp/gh-aw/agent/builds.json | jq -r '.value[] | "\(.id) \(.result) \(.finishTime)"' | head -25
 ```
 
-If selection yields no scannable build, record the matching skip reason (`stale build window (>14d)`, `no follow-up build yet, defer to next run`, or `no failed build in 7d`) and stop.
+If selection yields no scannable build, apply **Hard Rule 10** immediately.
 
 ## Step 2 - Walk the timeline