Backend fallback: try next backend in chain before failing closed

[HaleTom]

Summary

When the primary backend (Claude CLI) fails, aurscan fails closed to SUSPICIOUS without trying the remaining backends in the preference chain (Codex CLI, API key, local model, etc.).

Expected behaviour

Per the README authentication order, backends are auto-detected in order:

1. Claude Code CLI
2. ANTHROPIC_API_KEY
3. Codex CLI
4. Local/self-hosted model (AURSCAN_OPENAI_URL)
5. Custom command (AURSCAN_BACKEND)
6. No backend (static rules only)

If the Claude CLI fails, aurscan should fall through to the next available backend (e.g. Codex CLI) before failing closed.

Actual behaviour

:: Downloading PKGBUILDs...
 PKGBUILDs up to date
  scanning shuck-bin-release-git (2 files) ...
SUSPICIOUS shuck-bin-release-git (confidence 0%)
  Scan failed: claude CLI failed:  (fail-closed)
!! Build blocked: 1 package(s) flagged SUSPICIOUS.
  [A]bort (default) / [c]ontinue anyway: ^C%

The Claude CLI failed and aurscan immediately failed closed to SUSPICIOUS. Codex CLI is installed and logged in, but was never attempted.

Configuration

Variable	Value
AURSCAN_BACKEND	unset (auto-detect)
Claude CLI	present in PATH but failed
Codex CLI	present in PATH, logged in

Proposal

When a backend fails (error, timeout, non-zero exit), attempt the next backend in the preference chain before failing closed. Only fail closed if all available backends are exhausted.

aurscan version

0.5.2

Environment

• Arch Linux (AUR package aurscan-manticore-bin-release-git)

[GeorgelPreput]

I've proposed something similar in #7 , will try for a PR soon

[GeorgelPreput]

PR is at #36, reviews very welcome. It's a Claude Code implementation though, since I'm not familiar enough with Go as a language.