[cx-atish-jadhav]

By submitting this pull request, you agree to the terms within the Checkmarx Code of Conduct. Please review the contributing guidelines for guidance on creating high-quality pull requests.

Description

Removes the feature-flag checks for the seven flags that are now 100% open, keeping only the "enabled" behaviour and deleting the legacy paths, as requested in AST-188568 (epic AST-189176).

Flag	Change
AI_SUPPLY_CHAIN_ENGINE_GA_ENABLED	addAiscScan no longer checks the flag; AISC config is added whenever aisc is a selected scan type
INCREASE_FILE_UPLOAD_LIMIT	uploadZip uses multipart upload whenever the archive exceeds MaxSizeBytes (5 GB)
OSS_REALTIME_ENABLED	Gate removed from the oss, iac, containers and secrets realtime services; IsFeatureFlagEnabled and RealtimeEngineNotAvailable removed
RISK_MANAGEMENT_IDES_PROJECT_RESULTS_SCORES_API_ENABLED	cx results risk-management no longer returns "unavailable for your tenant"
SSCS_COMMIT_HISTORY_ENABLED	--git-commit-history is always honoured; the "not available" warning is removed
SSCS_NEW_LICENSING_ENABLED	New (Repository Health / Secret Detection) licensing only: legacy scs / enterprise-secrets engine handling removed from jwt-helper, scan.go, cx hooks pre-commit/pre-receive license checks
KICS_PRESETS_MANAGER_ENABLED	Removed from the integration-test skip guard (no production usage); NEW_PRESET_MANAGEMENT_ENABLED is intentionally left as-is

Also removes the FeatureFlagsWrapper parameters (and plumbing through NewHooksCommand, HookDispatchCommands, the agent-hook scanners, the realtime commands, etc.) that became unused, and updates the JWT mock to return the new-licensing engines.

No CLI flag names, output formats or exit codes change.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update

Cleanup / feature-flag removal. Behaviour is unchanged for tenants where all seven flags are already on (see Additional Notes for the exception).

Related Issues

• AST-188568 (task), AST-189176 (epic)

Checklist

• I have performed a self-review of my code
• I have added tests that prove my fix is effective or that my feature works
• I have added necessary documentation (if appropriate)
• Any dependent changes have been merged and published in downstream modules
• I have updated the CLI help for new/changed functionality in this PR (if applicable)
• All active GitHub checks for tests, formatting, and security are passing
• The correct base branch is being used

Additional Notes

Do not merge until the flags are re-confirmed at 100% in every environment (draft PR for that reason).

Behaviour that changes only where a flag was previously off:

• Legacy SCS / Enterprise Secrets licenses are no longer recognised; cx hooks pre-commit/pre-receive now require Secret Detection.
• Archives over 5 GB were previously sent single-part when INCREASE_FILE_UPLOAD_LIMIT was off.
• The old upload check ignored a flag-lookup error and dereferenced the result; that nil-dereference risk is gone with the check.
• If the feature-flag service is unreachable, these paths no longer fall back to the old flag-off defaults.

Test changes: tests that exercised the flag-off / legacy paths were removed; the flag-on equivalents are kept. TestGetDefaultEngines / TestGetEnabledEngines now assert the real engine lists.

Local verification (not a substitute for the PR checks): unit tests for internal/commands fail the same 8 environment-dependent tests on main and on this branch (Windows permissions, Docker/KICS, SCA resolver), and there are no new failures; lint findings are equivalent to main. Integration tests were not run locally.

🤖 Generated with Claude Code