License scanning unavailable: deps.dev returns gRPC Unavailable

## Summary

OSV-Scanner licence scanning is repeatedly failing after successful package
extraction because the upstream deps.dev request returns gRPC `Unavailable`.

This appears to be a recurrence of #2737, which was previously attributed to
intermittent deps.dev API unavailability.

## Environment

- OSV-Scanner: `2.4.0`
- OSV-Scalibr: `0.4.5`
- Commit: `b56b5191101d5f27d4787d5583d8d01e9518a7af`
- Platform: Linux amd64
- Date observed: 25 July 2026
- Inputs: one Go module and one npm lockfile

## Command shape

```console
osv-scanner scan source \
--lockfile /go.mod \
--lockfile /package-lock.json \
--licenses \
--all-packages \
--format json \
--output-file /license-inventory.json
```

## Actual behaviour

Package extraction succeeds:

```text
Scanned /go.mod file and found 8 packages
Scanned /package-lock.json file and found 274 packages
End status: 0 dirs visited, 2 inodes visited, 2 Extract calls
rpc error: code = Unavailable desc = service unavailable
```

The command returns status 127 and does not produce a valid JSON inventory.
Five attempts with exponential delays of 15, 30, 60 and 120 seconds all failed
with the same response. The failure has also been observed on repeated runs
during the day.

## Expected behaviour

Licence inventory succeeds, or the scanner provides a supported
resilient/offline path for licence metadata when deps.dev is temporarily
unavailable.

## Questions

1. Is deps.dev currently experiencing a known incident or regional degradation?
2. Is there a public status channel for OSV-Scanner's deps.dev dependencies?
3. Is there a supported way to cache or use previously resolved licence
metadata when dependency inputs are unchanged?
4. Would the project consider distinguishing this upstream infrastructure
failure more explicitly in the exit status and diagnostics?

No repository source or private package names are included in this report.

Start by reproducing the provided osv-scanner command with --licenses and reviewing how the scanner handles deps.dev gRPC Unavailable responses and exit status 127. Compare the recurrence with issue #2737 and determine whether the project has an existing cache, offline path, status guidance, or diagnostic convention. Done should mean an agreed resilient behavior or a clearly documented limitation and failure mode.

Written by the indexing model from the issue text.