CW-5: Codacy SARIF guard removal breaks CI in unauthenticated contexts

[Justus-at-Tazama]

Source: PR #366 (feat-paysys-simulation-v2) - post-hoc review finding CW-5

Problem

A guard in .github/workflows/codacy-ci.yml that created a minimal valid SARIF file when Codacy ran unauthenticated (or produced no findings) was removed in this PR. This reverts to the pre-guard behaviour where an empty or missing results.sarif causes the CodeQL SARIF upload step to error.

If Codacy ever runs in an unauthenticated context - for example in a fork, after token expiry, or in a dependency review run - CI will break on the SARIF upload step rather than continuing cleanly.

Fix

Restore the guard that creates a minimal valid SARIF file when the Codacy output is empty or absent:

- name: Ensure valid SARIF
  run: |
    if [ ! -s results.sarif ]; then
      echo '{"version":"2.1.0","runs":[{"tool":{"driver":{"name":"Codacy","rules":[]}},"results":[]}]}' > results.sarif
    fi

Severity

Can Wait - only affects CI resilience in unauthenticated/fork contexts; no impact on normal authenticated runs.

Estimated fix: 10 min