Raise failure on SBOM fetch errors

[lelia]

Summary

When the full-scan SBOM stream fetch failed, Core.get_sbom_data logged at debug level and returned {}, so report generation continued and produced empty GitLab dependency-scanning, license, and SARIF output with exit code 0. The most common trigger was SocketDev/socket-sdk-python#101: a single artifact with a purl type the SDK didn't recognize (e.g. generic) failed the whole stream parse. That parse fix shipped in socketdev 3.4.2 and is covered by the socketdev==3.5.0 pin already on main; this PR fixes the CLI-side failure handling.

Changes

• Core.get_sbom_data now logs at error level and raises APIFailure when the stream fetch fails, so the run goes through the existing API-error handling (exit code 3 by default; --disable-blocking still exits 0) instead of emitting empty reports
• Version 2.6.2 with a changelog entry

Testing

• New regression test test_get_sbom_data_failure_raises
• pytest tests/unit tests/core against socketdev 3.5.0: 421 passed, 2 skipped (pre-existing)
• Validated against the published SDK end to end: live full-scan stream fetch through Core.get_sbom_data, a stream containing a generic artifact flowing through package processing with alerts intact, and the failure path raising instead of writing empty reports

Ref: CE-360

---

Note

Low Risk
Narrow change to error handling on an already-failed SBOM fetch; success paths unchanged and behavior improves CI signal by avoiding silent empty reports.

Overview
SBOM stream failures now fail the run instead of writing empty reports. When Core.get_sbom_data gets success: false from the full-scan stream API, it logs at error and raises APIFailure instead of returning {}. Report generation no longer continues with blank GitLab dependency-scanning, license, and SARIF output and exit code 0; the failure follows existing CLI API-error handling (default exit 3, --disable-blocking still exits 0).

Release 2.6.2 updates version metadata and changelog. A regression test asserts the raise path. The changelog notes the common parse failure (e.g. unrecognized generic purls) is addressed in socketdev 3.4.2+, already pinned at 3.5.0 on main—this PR is the CLI-side handling fix.

^{Reviewed by Cursor Bugbot for commit f9a4831. Configure here.}

[lelia]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 77b18a7. Configure here.}

[lelia]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit d0c5648. Configure here.}

[lelia]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit f9a4831. Configure here.}