feat(telemetry): report unusable scan targets and count them as failure loops

[lab700xdev]

Why

Since the fix that made an unusable scan target exit 1, a missing path, broken symlink, or unsupported single-file target fails correctly — but silently:

• No cli_error. A target error has no exception object, so it never reached an emit site. It only showed up in parse_error_count, indistinguishable from a corrupt model.
• It reset the stale-loop counter. The loop detector only counted fetch failures, so every run of a scheduled job pointed at a typo'd path called record_success — the exact unattended-CI case the nudge exists for could never trip it.

What changed

• scanner.py: _record_target_error now requires a reason from the closed set TARGET_ERROR_TYPES = MissingTarget / UnsupportedFileType / NotAFileOrDirectory, chosen at the call site. Unknown values raise. The path, extension, and message never feed it.
• cli.py:
  • One cli_error per target error: command, error_type (the reason), http_status: "none", token_present, target_type, consecutive_failures.
  • Target errors feed loop_state (a fetch failure, when present, still owns the fingerprint). The nudge prints after the "Cannot scan" line with a check-the-path hint instead of the auth hint.
  • cli_scan gains target_error_count. parse_error_count is unchanged so existing reports stay comparable.
• README.md Telemetry & Privacy: documents target_error_count, the target-error cli_error and its fixed error_type values, and the widened loop_state.json fingerprint. "What's never collected" remains true verbatim.

Privacy

No new class of data: target_type was already a bucket, and the only addition is a three-value reason string plus a count. A test plants a distinctive directory name and extension and asserts neither — nor the user-facing message — appears anywhere in the emitted events. AISBOM_NO_TELEMETRY=1 suppresses the event (asserted at the _do_post layer); the local-only loop_state.json is still written.

Verification

• poetry run pytest --cov=aisbom --cov-fail-under=85 → 1170 passed, 92.91%
• poetry run aisbom bypass-scorecard --check → passed
• New tests/test_target_error_telemetry.py (22 tests): reason per cause (missing, dangling symlink, unsupported, FIFO), closed set under odd extensions, exact payload, no-leak, opt-out, nudge on 3rd run + ordering, clean scan clears the loop, different causes don't share a count, target_error_count vs parse_error_count. Existing fetch-failure telemetry tests pass unchanged.
• Manual run of the real CLI against a missing path ×3 with an isolated state dir: consecutive_failures 1→2→3, nudge on run 3, loop_state.json cleared by a subsequent clean local scan.