feat: add SKIP_SOCKET_REACH and SKIP_SOCKET_SUBMISSION env vars for Node.js Socket CLI integration

[jdalton]

Summary

Add support for SKIP_SOCKET_REACH and SKIP_SOCKET_SUBMISSION env vars to enable Node.js Socket CLI integration. This allows the Node.js Socket CLI to run socket-basics in the background, collect the .socket.facts.json file, and submit it along with manifest data in a unified API call.

Motivation

The npm Socket CLI wants to integrate socket-basics. To achieve this:

1. Background Execution: socket-basics runs in parallel with manifest collection
2. Unified Submission: Single API call with all findings (manifests + socket-basics facts)
3. Consolidated View: One scan ID on the dashboard showing all security findings

Without this change, socket-basics would submit independently, creating fragmented results.

Changes

Code Changes

• socket_basics/socket_basics.py: Added environment variable check in submit_socket_facts()
  • When SKIP_SOCKET_REACH=1, skips tier 1 reachability scans (coana)
  • When SKIP_SOCKET_SUBMISSION=1, skips Socket API submission
  • Still generates .socket.facts.json with all findings
  • Returns socket_facts_path in results for downstream tools

Documentation Changes

• README.md: Added "Integration Environment Variables" section
  • Documents SKIP_SOCKET_REACH and SKIP_SOCKET_SUBMISSION
  • Explains use case for external tool integration

How It Works

# Normal operation - socket-basics submits to API
docker run socketdev/socket-basics:latest

# CLI integration mode - socket-basics generates facts but doesn't submit
  docker run \
    -e SKIP_SOCKET_SUBMISSION=1 \
    -e SKIP_SOCKET_REACH=1 \
    socketdev/socket-basics:latest
# CLI then collects .socket.facts.json and submits with other data