fix(production-scan): stop silent Stage-4 skip — locate renderer up front + mandatory publish

[Gandy2025]

Problem

A production-scan trial scanned a public repo but never rendered the report or uploaded it to S3 — it ended the turn with no report file, no hosted report.first-tree.ai/<key>.html URL, and no honest "upload failed" line. The agent's own account: it concluded "there is no callable uploader" even though scripts/render-report.mjs was present in its checkout. Nothing caught the half-finished run.

Root cause is a discovery + fallback gap, not a missing step: the skill spells out render (Stage 3) and upload (Stage 4), but the free-running agent, deep in a long scan with cwd in the scanned repo (not the skill), couldn't wire up the skill's own renderer path, decided the tool didn't exist, and silently stopped.

Fix (SKILL.md prose only — no code, no runtime change)

1. Stage 1.1a preflight — locate the toolchain up front. Before the heavy scan (while context is short), find render-report.mjs on disk and derive SKILL_DIR from where it actually is, then reuse that resolved absolute path as <skill-dir> in Stages 3/4. Because the renderer is located from the real filesystem, the agent can't later claim "no uploader". Graceful when genuinely absent: finish the scan, deliver the in-chat report, emit the honest upload-failed line — don't abort before findings exist.
2. honest-URL rule — make publish mandatory and un-skippable. For a public repo, ending with only an in-chat summary and no final line is a FAILED run, not a lighter success. Forbid skipping publish on a belief ("no uploader/creds so I'll stop"), and allow the ⚠️ Report upload failed line only after a real non-zero exit quoting the real error. Explicit carve-out: the Stage 4.1 step-0 public-repo gate remains the one legitimate no-publish path (fail-closed, in-chat only).

Scope / tradeoff

Deliberately minimal and skill-only. This substantially lowers the failure rate and converts a silent no-report into either a hosted URL or a loud honest failure line — but it can't fully eliminate the failure, because the tail is still executed by a free-running agent (a dropped tool call / turn-budget exhaustion remain possible). Eliminating that entirely would require moving render+upload out of the agent (out of scope by request).

Verification

• node --test scripts/render-report.test.mjs → 17/17 pass (prose-only change; renderer untouched).
• Preflight snippet passes bash -n.
• Reviewed for internal consistency against the public-repo gate, private/fail-closed path, cache-HIT flow, injection-defense, and the completion-gates table — no contradiction.

🤖 Generated with Claude Code