fix(matrix): DAST needs an http(s) endpoint; don't offer/run it on modbus:// (#182)

compliance-agent/src/pipeline/orchestrator.rs

@@ -409,11 +409,17 @@ impl PipelineOrchestrator {
             new_count += self.run_ics_probe(target, &target_id, scan_run_id).await?;
         }
         if plc || ics {
-            // PLC/SPS device: also DAST against a WebVisu / exposed endpoint. The
-            // control-logic scan already consumed the code artifact, so the SAST
-            // pipeline is not re-run.
-            self.update_phase(scan_run_id, "dast_scanning").await;
-            self.maybe_trigger_dast(&target_id, scan_run_id).await;
+            // PLC/SPS device: also DAST against a WebVisu / exposed endpoint, but
+            // only when DAST is actually planned — a device reachable only over an
+            // industrial protocol (e.g. modbus://) has no web surface to crawl, and
+            // running DAST there just fails at reconnaissance. Gating here (not only
+            // at provisioning) also stops a DAST target left over from an earlier
+            // run from re-triggering. The control-logic scan already consumed the
+            // code artifact, so the SAST pipeline is not re-run.
+            if plan.has(ScanType::Dast) {
+                self.update_phase(scan_run_id, "dast_scanning").await;
+                self.maybe_trigger_dast(&target_id, scan_run_id).await;
+            }
             return Ok(new_count);
         }