Fix silently swallowed and lossy error handling

[devin-ai-integration]

Summary

Audit of every catch in src/ plus the paths where a failure was either discarded or allowed to take down more than itself. Six behavioral fixes:

One unreadable file no longer destroys a whole scan. runScan awaited readFile unguarded, so a permission error or a file deleted mid-scan threw and every other file's results were lost. Failures are now collected and the scan continues:

try { content = await readFile(file, 'utf-8'); }
catch (error) { fileErrors.push({ file, message: formatError(error) }); continue; }

ScanReport.fileErrors / ScanSummary.filesFailed are new (breaking for programmatic consumers constructing these types) and are surfaced in all three report formats. Crucially they also fail the run — CLI exitCode = 2, core.setFailed in the Action — so a partially-failed scan can't look green.

HEAD errors were thrown away. performRequest had a bare catch {} around the HEAD request that blind-retried with GET, so the original failure vanished and a timeout got retried, silently spending twice the caller's --timeout budget. Now timeout/abort/cancel rethrow immediately, and a failed GET carries the HEAD error as cause.

error as AxiosError was a lie. A thrown non-Error made axiosError.message undefined and the result reported "Unknown network error" instead of the actual value; timeout detection relied on a message.includes('timeout') substring and missed ETIMEDOUT/ERR_CANCELED. Now uses axios.isAxiosError, classifies by code, and propagates the code as CheckResult.errorCode (also in the JSON report).

Promise.all in runWithConcurrency lost errors — the first rejection returned while the rest of the pool kept running unobserved. Replaced with settle-all plus an AggregateError, and a worker that throws unexpectedly is converted into a broken result for that URL rather than aborting the scan.

Auxiliary Action failures masked the verdict. A PR-comment or step-summary failure called setFailed, reporting a link-check failure that never happened; both are now core.warning. Conversely getBooleanInput silently read any non-true value as false and getNumberInput silently fell back on garbage — both now reject invalid input with the offending value.

Only error.message ever reached the user. New src/errors.ts renders the full cause chain and nested AggregateError.errors (stacks behind --verbose / core.debug), Zod config failures print as one readable line per bad option instead of a raw dump, numeric CLI options are validated against the flag name rather than reaching Zod as NaN, and report writers create the parent directory and name which report/path failed.

npm run lint, typecheck, test (61 tests), build, format:check all pass.

Link to Devin session: https://app.devin.ai/sessions/35b225657ebf4551a926985790de4095
Requested by: @lahcenassmira

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring