/cso: scanner catalog is empty on every platform; the 'no qualified image for linux/arm64' message blames the host architecture #2940

gstack 1.87.6.0 (636175d), gstack-cso 3.0.0 (helper ABI 3), macOS arm64 with Docker.

Symptom

Every /cso run adds a not_assessed record for gitleaks, semgrep and OSV, so no run can report complete. The message blames the host architecture:

$ gstack-cso scan <run> gitleaks
"status": "not_assessed",
"message": "No qualified gitleaks image for linux/arm64; qualify and review an immutable scanner catalog before execution"

The same message appears for semgrep and osv.

Actual cause

The architecture isn't the problem. The committed catalog is empty on every platform:

$ jq -c '{revision,n:(.scanners|length)}' lib/cso/scanner-images/catalog.json
{"revision":"cso-scanners-v3-unqualified","n":0}

build-inputs.json and qualification.json are both still "state": "pending". An amd64 host gets the same result with linux/amd64 in the message. The upstream images aren't the blocker either. docker buildx imagetools inspect shows linux/amd64 and linux/arm64 manifests for ghcr.io/gitleaks/gitleaks, semgrep/semgrep and ghcr.io/google/osv-scanner.

Impact

• Users read the message as an arm64 gap and try switching machines, moving to CI or installing Docker. None of that can help. /cso withholds whole source files that read an API key from the environment (env.kv false positive + locateSpan cannot relocate ^-anchored matches) #2912 hit the same confusion.
• Nothing can make /cso report complete today, so a status of partial no longer tells users anything. The helper allows no host-executable or alternate-image fallback, which is by design.

Ask

1. Word the gap as "the scanner catalog has not been qualified yet (revision cso-scanners-v3-unqualified)" rather than naming the host platform, and say the same in /cso --doctor and the /cso docs.
2. Is there a timeline for the protected cso-scanner-images.yml qualification and promotion run?
3. Until then, could scanner gaps from an empty catalog be classed as a known distribution prerequisite and kept out of the run's completeness? That way partial would again mean assessment work was left undone.