What's the difference between --fail-on error and --fail-on warn?

--fail-on error exits with code 2 only if error-level findings exist (e.g., runtime near EOL, framework 3+ majors behind). --fail-on warn exits with code 2 if warning-level OR error-level findings exist. Use --fail-on error in CI to catch critical issues; add --fail-on warn when you want stricter enforcement.