Unknown check IDs passed to --check are silently ignored #7614

Codex:

Describe the issue

Checkov silently ignores unknown policy IDs supplied through --check. If at least one requested policy exists and passes, Checkov exits successfully even though another explicitly requested policy never ran.

This makes a misspelled, renamed, deleted, or unregistered external policy indistinguishable from a successful scan in CI.

Version

checkov 3.3.7 with Python 3.12.

Minimal reproduction

Create a Dockerfile whose known policy passes:

FROM alpine:3.20
HEALTHCHECK CMD true

Run one valid check and one nonexistent check:

checkov \
  --framework dockerfile \
  --file Dockerfile \
  --check CKV_DOCKER_2,CKV_DOCKER_DOES_NOT_EXIST \
  --quiet

echo "$?"

Checkov reports the valid check as passed, says nothing about CKV_DOCKER_DOES_NOT_EXIST, and exits 0.

I also reproduced this with Python checks loaded through --external-checks-dir: one valid external ID plus one nonexistent external ID returned 0.

Expected behavior

When the user explicitly supplies an exact policy ID through --check, Checkov should either:

1. exit nonzero when any requested ID is unavailable; or
2. provide a strict option that validates every requested ID before scanning.

At minimum, the CLI should emit a clear warning naming every unknown requested ID.

Why this matters

Teams use --check as an enforcement allowlist. External policies can fail to register or be renamed while the remaining policies still run and keep CI green. Consumers currently need to parse structured output themselves to verify that every requested policy executed.