Working-tree diff findings can show source excerpts from HEAD instead of scanned changes #514

Summary

Finding details for a working-tree diff scan can display a source excerpt from the committed HEAD blob rather than from the uncommitted content that was actually scanned.

Root cause

workbench_scan_start.scan_target_identity() stores target_revision = diff_target["headRevision"] and leaves target_snapshot_digest = None for diff scans. A working-tree diff stores its mutable-content identity separately in diff_content_digest.

workbench_source_excerpt.scanned_source_text() currently treats a None snapshot digest as eligible for Git-object lookup and executes the equivalent of:

git cat-file blob <target_revision>:<path>

For diff_target_kind = "working_tree", <target_revision> is the repository HEAD. If the finding is in an uncommitted modification, that blob is the pre-change file and can therefore disagree with the source that produced the finding.

Committed commit and range diff targets do not have this ambiguity because their head revision is the reviewed immutable source.

Impact

The sourceExcerpt attached to a saved finding can present incorrect evidence for working-tree diff scans. This is especially confusing when the affected lines were added or materially changed in the working tree.

Expected behavior

Do not synthesize an excerpt from HEAD for a working-tree diff. Until the helper can authenticate and read the exact working-tree snapshot identified by diff_content_digest, it should fail closed and omit the excerpt.

Migrated/unknown diff target kinds should fail closed for the same reason, while committed commit and range diff targets can continue reading the stored head revision.