add --reach-version and --fix-version flags to override the default Coana version

[mtorp]

Adds the options --reach-version and --fix-version to override the default Coana version used in the CLI.
Updates the CLI to version 1.1.40.

---

Note

Adds --reach-version and --fix-version flags to override the @coana-tech/cli version, wiring the value through to Coana execution across reachability and fix flows.

• CLI Flags
  • socket scan create / socket scan reach: new --reach-version to override @coana-tech/cli version.
  • socket fix: new --fix-version to override @coana-tech/cli version.
• Execution Layer
  • spawnCoanaDlx in src/utils/dlx.mts accepts coanaVersion and uses it when invoking @coana-tech/cli.
  • Plumb reachVersion/coanaVersion through perform-reachability-analysis, cmd-scan-*.mts, and fix pipeline (cmd-fix.mts → handle-fix.mts → coana-fix.mts).
• Defaults & CI
  • Include reachVersion (default undefined) in CI and GitHub scan creation configs.
• Docs/Help & Tests
  • Update help text and snapshots to document new flags.
  • Test utilities normalize Coana version in outputs for stable snapshots.
• Changelog/Version
  • Bump to 1.1.40 and document new flags in CHANGELOG.md.

^{Written by Cursor Bugbot for commit aaba0a2. Configure here.}

[mtorp]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no bugs!

---

Comment @cursor review or bugbot run to trigger another review on this PR

[jdalton]

@mtorp How does this mesh with the process.env['SOCKET_CLI_COANA_LOCAL_PATH'] stuff? Is that more for development and this flag more user-facing? I like the flag, also versioned reachability is kind of a cool thing to have.

[mtorp]

@mtorp How does this mesh with the process.env['SOCKET_CLI_COANA_LOCAL_PATH'] stuff?

Yea, that's a dev only feature.

I think 99% of all users will never use any of these flags, but they are nice to have in case we want to quickly bump the Coana version to fix a bug, without having to wait for a Socket CLI release.