AST-173242: Improve KICS container engine fallback and remediation flow - #1561

Summary

Hardens the KICS container-engine fallback (Docker/Podman) with clearer error reporting when both engines are installed but not running, reworks the agent remediation guidance to route every IaC finding through a single MCP flow with skill-driven remediation and explicit suppress commands, and adds AI telemetry for KICS scans and blocked findings.

Changes

Container engine fallback

• Before: When the primary engine (Docker/Podman) failed and no fallback engine was configured, the raw underlying error was returned as-is, which could be ambiguous when both engines were installed but neither daemon was running.
• After: Added IsEngineInstalled (presence-only check, independent of daemon state) and bothEnginesInstalledButStopped/scanErrorAfterNoFallback to detect the "both installed, both stopped" case and surface a clear, actionable error ("Start Docker Desktop or the Podman machine and retry.") instead of a single-engine failure message.

Remediation guidance (kics/delta.go)

• Before: Findings were routed to either imageRemediation (Dockerfile/docker-compose) or codeRemediation (everything else) MCP tools, based on a platform/filename heuristic. Guidance instructed the agent to fix every finding unconditionally, with no suppression path surfaced.
• After: All KICS/IaC findings now go through codeRemediation only (the image-specific path and its heuristics were removed). Guidance now:
  • Points the agent at a dedicated remediation skill (cx-devassist-kics / /cx-devassist-kics, agent-specific) that reuses the findings already in context instead of rescanning.
  • Emits ready-to-run cx ignore-vulnerability suppress commands per finding (with --ignored-file-path and --optional-flags for provenance), including a Cursor-specific quoting/PowerShell-safe variant.
  • For Cursor, changes the flow from "fix everything automatically" to asking the user to choose remediate vs. suppress per finding, with an explicit warning not to suppress just because a change looks intentional.
  • Falls back to instructing the user to reconnect the Checkmarx MCP when the skill/tool isn't available.

Telemetry (kics/kics.go, cx/hooks.go)

• ScanFileEdit now also returns the highest severity across findings (highestSeverity) and takes *agenthooks.FileEditEvent plus a wrappers.TelemetryWrapper/agent name.
• Every KICS scan now logs an AI telemetry event (logKicsTelemetry) with the finding count; hooks.go additionally logs remediation telemetry with severity when an edit is blocked.

Testing

• go build ./...
• go test ./internal/commands/agenthooks/... ./internal/services/realtimeengine/iacrealtime/... — all packages pass