fix(sentinel): upload the SARIF it just wrote

[Ndevu12]

The sentinel's two SARIF upload steps have never run.

Both were guarded by:

if: ${{ always() && hashFiles(format('{0}/latest.sarif', runner.temp)) != '' }}

hashFiles() resolves paths against GITHUB_WORKSPACE and cannot see runner.temp, so it returned
empty on every run and both uploads skipped — whether or not the file had been written.

The last run shows it plainly: the scan wrote the file, and the artifact step was skipped anyway.

SARIF written to /home/runner/work/_temp/latest.sarif
Security alerts processed: 1 infected, 0 suspicious, 0 clean.
##[error]Process completed with exit code 1.

  4. failure  Scan, alert, and emit SARIF
  5. skipped  Upload SARIF to code-scanning
  7. skipped  Upload SARIF as build artifact

That fails exactly when it matters most: step 6 tells the reader findings are "delivered via the run
log, the SARIF build artifact below, and --alert" — and one of those three has never existed.

Fix

The scan step reports whether it wrote the file, and the uploads key off that instead of a check that
cannot see the path:

if: ${{ always() && steps.scan.outputs.sarif == 'true' }}

The verdict is unchanged

The exit code is captured, the flag recorded, then the step exits with it — so an infected main
still fails the run exactly as before. The always() guards stay, which is what lets the upload
happen despite that non-zero exit.