refactor(scan): scanners take file lines; MCP snippet scan uses postprocess (#610)

[ajianaz]

What

Final steps of #610.

1. Scanner seam. New engine::scan_input::ScanFile { path, language, lines: Vec<(u32, &str)> } is the one input shape. secrets_scanner::scan_secrets_in, security_scanner::scan_security_in, rules::run_rules_in and inline_suppress::apply_lines are the single implementations; scan_secrets / scan_security / run_rules / inline_suppress::apply keep their signatures and are thin diff adapters (ScanFile::added_lines / post_image). postprocess feeds cora scan through ScanFile::from_entry. files_as_chunks is deleted.
2. MCP cora.check_snippet now goes through postprocess_report as a synthetic snippet.<language> file (language sanitized to one path segment). It loads the project config like the other MCP tools (error Failed to load config: .. on failure), honors ignore.rules, inline cora-ignore:, the false-positive filters and rules_engine.max_findings, and appends the dropped count when > 0. Output format is unchanged.
3. Test isolation. The unit test that opens an IndexSession uses a per-test temp DB (IndexBridge::open_or_create_at / IndexSession::open_at_db, test-only). The migration mutex stays. tests/brain_search_process.rs sandboxes now use unique tempfile dirs (they used fixed cora-545-* names in the system temp dir, so two concurrent cargo test runs deleted each other's sandbox and both tests failed with No such file or directory; not a data-dir/vector-lock race).

Why

The scanners were written for diffs, so a full-file scan and the MCP tool had to fake a diff, and the MCP tool skipped every filter. One line-based seam means a scanner fix lands once and every entry point applies the same suppression.

Testing

• cargo fmt, cargo clippy --all-targets -- -D warnings clean; full cargo test run 3x clean (1130 unit tests + integration). secret_heuristics_tests.rs table (CASES/KNOWN_GAPS) unchanged and green.
• New tests: scan_input adapters, and MCP snippet tests (rule id, ignore.rules, cora-ignore same line / next line / other rule, FP shapes, path from language, cap + dropped count). None use a real data dir.
• Real binary vs origin/develop build: cora scan --format json and cora review --staged --format json on a sample project (TS typed/env/interpolation, Python env reads + cora-ignore, Go :=, YAML, JSON, SQL, tests path, Markdown) produce byte-identical output.
• MCP over stdio (cora mcp): before, cora-ignore and ignore.rules were ignored and 7 findings were listed (cap 10); after, the marker and ignore.rules suppress, and the default cap of 5 applies with "2 more deterministic finding(s) not shown".

Closes #610

🤖 Generated with Claude Code