fix: reject --fix combined with --sarif or --cdx

[Ayush7614]

Summary

• --fix --sarif and --fix --cdx now fail validation with a clear error (same pattern as --fix --json).
• Previously these combos were accepted, fixes applied, and no SARIF/CDX file was written — writeOutputs only runs on the non---fix path.
• Docs: CLI reference notes the incompatibility.

Why

Silent incomplete wiring: CI that ran cve-lite . --fix --sarif got a successful exit with no artifact, unlike --fix --json which already fails fast.

Test plan

• npm test -- tests/validate.test.ts
• e2e validation conflicts cover --fix --sarif / --fix --cdx
• npm run build

[sonukapoor]

Nice catch @Ayush7614, this is a real silent failure, not just a cosmetic guard. I traced it: writeOutputs() only runs in the non-fix branch (src/index.ts:624), so --fix --sarif and --fix --cdx really did apply fixes, exit 0, and quietly write nothing. Good that you verified --fix --report is fine (that write is unconditional, further down) and left it alone.

The placement is exactly right: grouped with the existing --fix cannot be used with --json check, same thrown-Error style, same stderr and exit-1 path, and the message wording matches our convention. Docs and the e2e conflict table are updated too.

One small thing before it goes in: in tests/validate.test.ts you added a "does not throw when --sarif is used without --fix" case but no matching one for --cdx alone. Every other conflict block in that file has the symmetric negative test, so could you add a does not throw when --cdx is used without --fix case to keep it consistent? Tiny ask, everything else looks solid.

[Ayush7614]

Addressed review: added the matching does not throw when --cdx is used without --fix case in tests/validate.test.ts.

[Ayush7614]

@sonukapoor thanks for the review — addressed:

• Added the matching does not throw when --cdx is used without --fix case in tests/validate.test.ts.

Also rebased this branch onto latest main.