ci: drop e2e_scan from PR-blocking matrix (live public-API dependency)

`e2e_scan` exercises `socket-patch scan --apply --yes` end-to-end
against the live public proxy at patches-api.socket.dev. The proxy
returns "Service temporarily over capacity" intermittently for
`/patch/by-package/*` lookups, and the test panics when scan reports
zero patches.

Move it out of the PR matrix; runnable on demand via
`cargo test -p socket-patch-cli --test e2e_scan -- --ignored`. The
other matrix entries (e2e_npm, e2e_pypi, e2e_cargo, e2e_golang,
e2e_maven, e2e_gem, e2e_composer, e2e_nuget) stay — they exercise
local crawler / apply paths, not the live API.

Assisted-by: Claude Code:claude-opus-4-7

Author: mikolalysenko

.github/workflows/ci.yml

@@ -407,10 +407,14 @@ jobs:
             suite: e2e_npm
           - os: macos-latest
             suite: e2e_pypi
-          - os: ubuntu-latest
-            suite: e2e_scan
-          - os: macos-latest
-            suite: e2e_scan
+          # `e2e_scan` is intentionally NOT in the PR matrix — it
+          # depends on the live public proxy at
+          # patches-api.socket.dev serving real patch data for
+          # `minimist@1.2.2`, which is subject to rate-limiting
+          # ("Service temporarily over capacity") and other
+          # availability quirks outside this repo's control. Run on
+          # demand with
+          # `cargo test -p socket-patch-cli --test e2e_scan -- --ignored`.
           # Safety-hardening e2e suites. The fast non-ignored ones
           # (e2e_safety_lock, e2e_safety_yarn_pnp) run via the
           # standard `test` job above on all three platforms, so no