Fail closed when repository policy dependencies are missing

[alxxjohn]

Motivation

• Folder-scans that omitted -config were incorrectly treating any os.ErrNotExist returned while loading a config as if the top-level config was missing, which allowed scans to silently fall back to built-in defaults when repository policy dependencies (e.g. external design rules) were absent.

Description

• Add a dedicated sentinel ErrConfigNotFound returned only when the top-level configuration file is absent and preserve underlying os.ErrNotExist for other missing artifacts by wrapping with fmt.Errorf("%w: %w", ErrConfigNotFound, err) in internal/codeguard/config/io.go.
• Expose the sentinel through the public SDK via pkg/codeguard/sdk_config.go as ErrConfigNotFound and update internal/cli/helpers.go to only allow configless fallback when service.ErrConfigNotFound is returned.
• Adjust error wrapping to use %w so callers can detect the sentinel reliably, and remove an unused import introduced during the change.
• Add a regression test TestRunScanFolderWithMissingDesignRulesDoesNotFallBack in tests/cli/scan_test.go that verifies a folder scan with an existing config referencing a missing design-rules file fails rather than falling back.

Testing

• go test ./... ran and completed successfully across packages.
• go test ./tests/cli ./tests/codeguard ran and completed successfully, and the added regression test exercised the failure path as intended.

---

Codex Task