Make failure_policy the single enforcement lever for the Pulse reusable
workflow, with names and default matching the GitLab secret-scan component so
the GitLab and GitHub surfaces behave identically.

failure_policy (default unverified):
- unverified — fail on verified/live secrets (exit 183); keep the job green on
  unverified findings (exit 185).
- strict — fail on any finding (183 or 185).
- all — warn only; never fail the job on findings.
Scanner/infra errors always fail closed; missing scan state fails the job.

Scan and reporting:
- Remove the caller-facing `results` input. The scan always runs with the
  broadest filter (--results=verified,unknown,unverified) so every finding
  class — including unverified findings such as private keys — reaches SARIF
  and is eligible for enforcement.
- SARIF labels each finding's verification state distinctly (verified /
  unknown / unverified), derived from the scanner's Verified + VerificationError
  fields; verified -> error, unknown/unverified -> warning, with the state also
  in properties.verificationState.

Testing:
- ci.yml exercises positive and negative cases across all three policies. The
  unverified and all negatives run end-to-end through the reusable workflow via
  the repo-guarded, CI-only ci_test_setup input (both expected to pass); the
  strict negative asserts the scanner's exact exit code (185).

Docs:
- README, workflow catalogue, and CHANGELOG updated.

Migration (pre-release interface change):
- Remove any `results:` input from consumer `with:` blocks.
- fail-on-findings: true  -> failure_policy: strict (or unverified to tolerate
  unverified findings)
- fail-on-findings: false -> failure_policy: all

…w catalogue