UID2-7011: skip zizmor scan when there is nothing to scan

[swibi-ttd]

Makes a repo with nothing to scan pass instead of fail, so the scan can be applied blanket-style (e.g. the UnifiedID2 required-workflow ruleset targeting ~ALL repos).

zizmor exit 3 ("no inputs collected") now splits by intent:

• default scan_paths: '.' → the repo genuinely has no GitHub Actions content → skip green with a summary notice
• explicit scan_paths → an empty collection is a probable typo → fail closed, as before

Verified empirically that a repo with no Actions content yields exit 3; actionlint + zizmor self-scan clean.

Also makes this repo's own caller bare (severity floors inherit the shared defaults — same effective values) and drops the with: line from the README adoption example.

Must merge and ship in a v3 release before uid2-okta-configuration#222 applies, since the ruleset-injected workflow calls @v3.

🤖 Generated with Claude Code

[BehnamMozafari]

Two things worth addressing on the new exit-3 handling before the gate flips to enforcing under UID2-7425 (non-blocking for merging this as staged report-only):

1. The skip-green path is fail-open and not falsifiable. On scan_paths='.', exit 3 → exit 0 based only on the exit code plus a SCAN_PATHS == "." string match. Exit 3 is generically "no inputs collected" — it doesn't confirm the repo is genuinely Actions-free vs. a collection/checkout anomaly — and this is exactly the path the org-wide required workflow uses. Unlike the normal path, the skip branch emits no evidence table (version / inputs-audited / floors / exit code), so a green skip is indistinguishable from a scan that silently did nothing, which cuts against this file's own "evidence so a green run is falsifiable" philosophy.

Suggest: grep zizmor.log to confirm the "no inputs collected" reason before going green, and emit the evidence table (+ the exit code) on the skip path so a skip is auditable as a deliberate decision.

(Realistic risk today is low — a GitHub-executed workflow lives in .github/workflows, which '.' scans — but this is the behaviour that matters once the gate is enforcing.)

2. This branch is untested and unreachable by this repo's own CI. Since uid2-shared-actions has Actions content, the self-scan always takes the 0|11|12|13|14 path and never exercises the new 3) case — neither the skip-green nor the explicit-paths exit 1 sub-branch. A quoting slip or an inverted if would merge green and ship in v3 with no signal, and the only current verification is a one-time manual check.

Suggest: add a shell/bats fixture test (empty repo + default ., empty + explicit scan_paths, non-empty) that pins "empty ⇒ exit 3 ⇒ skip green" against the pinned zizmor version, so a future upgrade can't silently reroute it.

[swibi-ttd]

@BehnamMozafari

1. Added a grep for no inputs collected and also show the summary table on the skip path
2. Would prefer not to set up tests for this as it would require some refactoring + the workflow isn't super critical. Will run some test manually after this is merged