Scan step stubs should return ErrNotImplemented (pipeline_step_scan_*.go) #67

Problem

module/pipeline_step_scan_sast.go, pipeline_step_scan_container.go, and pipeline_step_scan_deps.go all contain:

// TODO: Execute via sandbox.DockerSandbox once the sandbox package is available.

The steps currently appear to succeed silently without doing anything, giving false confidence in CI/CD pipelines.

Fix Direction

Either integrate with the sandbox package if now available, or have each step return a clear sentinel error (e.g. ErrNotImplemented) so pipeline authors know the step is non-functional. Add documentation noting the limitation.

Context

See docs/DEFERRED_ISSUES.md — Incomplete Implementations section.