Decompose scan and findings modules

[pengfei-threemoonslab]

Summary

• Replace the oversized cli/scan.py module with a cli/scan/ package organized around the existing scan phases and shared helpers.
• Replace the oversized core/findings.py module with a core/findings/ package split by identity, mutation, remediation, summary, reviewer, and report-building responsibilities.
• Preserve compatibility imports from agents_shipgate.cli.scan and agents_shipgate.core.findings, and add a smoke test to pin those re-exports.
• Update stale documentation, comments, and scanner static-coverage anchors for the new package paths.

Review follow-up

• Expanded the compatibility test to cover the remaining active core.findings re-exports.
• Extracted baseline-integrity handling plus public action/tool surface construction out of _sanitize_for_output.
• Moved manifest-path and placeholder validation helpers out of source_loading.py into cli/scan/validation.py.
• Renamed surface_sanitization.py to surface_redaction.py and removed non-canonical cli.scan re-exports for REGISTRY and manifest loaders.
• Replaced full-report serialization in reviewer-summary evidence gap counting with a narrow evidence-matrix payload.

Why

Concern A identified sustained file-size growth on the orchestrator and findings paths. The previous E3 decomposition reduced function-level complexity, but the next maintainability step is moving those named phase helpers into explicit package modules so future work lands in focused files instead of recreating monoliths.

Impact

This is intended as a behavior-preserving refactor. Public import paths, report schemas, exit codes, run IDs, finding fingerprints, and privacy redaction ordering are preserved.

Validation

• python -m pytest tests/test_e3_prime_compat.py tests/test_baseline_integrity.py tests/test_adapter_registry.py tests/test_adapter_contracts.py tests/test_reviewer_summary.py tests/test_reports.py tests/test_privacy.py tests/test_scan.py (179 passed)
• python -m pytest (1839 passed, 4 skipped)
• python -m ruff check .
• git diff --check