Use exact-pinned esbuild so the committed bundle is reproducible across CI runners, generate and ship complete dependency licenses, keep the bundle under a size ceiling, and route degraded scans through the shared operational-failure exit handling.
AI assistance: Codex audited PR #693 and implemented this hardening.
Skill and plugin copies of the detector had no htmlparser2/css-select/css-tree/domutils, so HTML scans silently fell back to regex and exited 0. Bundle those parsers into the engine tree and exit 1 if the fallback still fires.
AI assistance: Cursor Grok 4.6 implemented this change.
Co-authored-by: Cursor <cursoragent@cursor.com>