feat: preserve finding relationships in scan history - #574

Summary

Preserve confirmed, uncertain, and related finding relationships in the existing SQLite workbench. The existing matcher and CLI remain compatible; #575 builds the replacement matcher on this storage layer.

Changes

• Validate complete comparison results before replacing saved data, and keep related findings separate from confirmed duplicates.
• Reuse stable identities and confirmed links while preserving uncertainty, coverage rules, and saved comparison payloads.
• Add two indexes and batch relationship lookups through an append-only migration.
• Stream comparison JSON through UTF-8 stdin. Older custom plugins retain the original confirmed/uncertain format.
• Keep legacy scan records without target IDs scoped to their repository.
• Simplify alias bookkeeping to one parent map and preserve main's workbench stdin API and Python-resolution fixes.
• Exercise large comparison payloads and run Python probes through stdin instead of long command-line arguments.

There are no public CLI changes or new model calls in this PR.

Testing

• Focused history, publication-store, runtime, comparison, and CLI compatibility tests: 187 passed, 13 platform skips.
• Full SDK suite, Bun 1.3.14 with seed 12345: 1,510 passed, 29 platform/environment skips, zero failures.
• Type checking, formatting, Ruff on all four changed Python modules, and git diff --check passed.
• Build, pack, and installed-package inspection passed, including all 241 archive entries, 109 bundled plugin files, CLI execution, and nested-worker startup. The packed history module matches the reviewed source.
• The legacy-repository regression failed before the fix and passed afterward.
• A 10,000-match payload passed through stdin. A temporary argv mutant failed with E2BIG; the restored implementation passed.
• The simplified alias implementation matched the original across 203 deterministic graph cases, including a 10,000-link chain. Disposable verification probes are not included in the PR.

Risk and rollout

The append-only migration adds indexes without rewriting saved comparisons or completed scan artifacts. Index creation can hold SQLite's normal write lock on a large history. Older custom plugins need an upgrade to save related links or comparisons too large for command-line arguments.

Merge this PR before #575. This update merges main without rewriting branch history.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.