Whether the check could be made at all.
A check that could not run is reported as ran: false and never as a pass. That distinction is
the whole reason this is a record rather than a boolean: "the pack scrubber is not installed"
and "the pack carries no secret" are different facts and only one of them is safe to deploy on.
the exact command that fixes it, or null when there is nothing to run