fix(rf-cfjc): action.yml jq parser handles wrapped JSON shape

rafter ≥0.7.0 (since rf-0pch, 2026-04-27) wraps scan results as
{_note, scan_mode, triage_applied, results: [...]} instead of a bare
array. The composite action's count query [.[].matches[]] errored on
the new shape and silently fell through to "0", causing the Test
Composite Action 'detect secrets in fixture' job to fail with
"expected findings > 0, got 0" — even though the scanner correctly
detected the AKIA fixture.

Use a type-aware query that handles both the wrapped object (current)
and the bare array (older pinned versions).

Verified against both shapes locally; CI run #25598398886 log shows
the scanner already emits the correct match.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: Rome-1

action.yml

@@ -94,9 +94,12 @@ runs:
         echo "${OUTPUT}" >> "$GITHUB_OUTPUT"
         echo "RAFTER_EOF" >> "$GITHUB_OUTPUT"
 
-        # Count findings from output
+        # Count findings from output. rafter ≥0.7.0 wraps results in an object
+        # ({_note, scan_mode, triage_applied, results: [...]}); older versions
+        # emitted a bare array. Handle both so users pinning `version:` to an
+        # older release don't break.
         if [ "${{ inputs.format }}" = "json" ]; then
-          COUNT=$(echo "${OUTPUT}" | jq '[.[].matches[]] | length' 2>/dev/null || echo "0")
+          COUNT=$(echo "${OUTPUT}" | jq '[(if type == "array" then . else .results end) | .[]?.matches[]?] | length' 2>/dev/null || echo "0")
         else
           COUNT=$(echo "${OUTPUT}" | grep -c 'Secret:' 2>/dev/null || echo "0")
         fi