feat!: authenticate the cache, contain config paths, report what was not scanned (1.3.0)

[aksOps]

Closes the confirmed blocker and twelve concerns from the v1.2.0 production gate review, plus three blockers and nine minors the adversarial re-review found in the fixes themselves. Cut as 1.3.0: new exit-2 conditions and a new public field are not patch-safe.

The blocker

A repository could commit a poisoned .siloscan/cache and a fresh clone would scan clean over a live credential - exit 0, no warning, nothing. Content-hash keying does not help, because the attacker's entry key legitimately matches the file. Cache entries are now authenticated per cache directory: a salt bound to the cache location, an authentication tag over the whole stored entry, and a mismatched or foreign tag is a miss (a real scan), never a trusted zero. Reproduced in its strongest form during verification - forging a valid tag under the attacker's own salt, proven to suppress the finding in their checkout - and defeated in a fresh clone by location binding alone.

On Windows the salt lives in an NTFS alternate data stream, which no archive or git checkout carries; unsupported platforms trust no salt and scan cold. The Windows runtime path is type-checked cross-target but not executed here - failure direction is a cold cache, never a false clean.

Trust boundary

• Config path containment now resolves symlinks. The lexical guard was bypassable with 'ln -s ../outside link' plus 'rules = ["link"]'. Both the config and the symlink are tree content.
• Project ignore matchers are rooted at the declaring file. ignore's add_ignore roots matchers at the process CWD, so an anchored pattern like '/modules/api/secrets/' hid a credential when run from the repo root and reported it when run from /tmp. Same tree, same command, different answer.
• Zero rules, unusable coverage reports, and escaping config paths exit 2. A typo'd --rules path was a permanently green CI job; a coverage gate with no report, or one matching no scanned file, passed silently. A gate that cannot evaluate must fail.

Saying where it did not look

• Ignored file and directory counts in JSON, SARIF (siloscan/ignored) and the human summary, so 'clean' is distinguishable from 'did not look'. An in-root .gitignore still excludes files - now counted. Costs +0.26s on an 88k-file tree, measured and documented.
• anchor=config consults ignore files between the config root and the scan root, restoring the module/root scan interchangeability that 1.2.0 broke for shared baselines.

Interop and robustness

• SARIF URIs percent-encoded (unencoded paths were non-conformant and truncated at '#') and columns character-based (17 vs 29 after a CJK prefix). ASCII-only output is byte-identical to 1.2.0 apart from the version string.
• The terminal sanitizer also escapes Unicode bidi controls, closing the Trojan Source half of the forgery hole. Arabic and Hebrew text is untouched.
• stderr writes tolerate a broken pipe: 80 runs, exit codes only ever 0/1/2, never 101.
• A foreign cache salt is replaced rather than permanently disabling the cache; entry authentication coverage is guarded by exhaustive destructuring so a new field cannot silently fall outside the tag.

Verification

• 807 workspace tests; clippy -D warnings and fmt clean; MSRV 1.96 checked (1.95 correctly rejected).
• All 11 repro groups from this round plus every repro from the two previous rounds re-run against the release binary.
• Determinism: a 6064-finding fixture (hidden files, binaries, ignored files, an oversized file with a boundary rule, secrets, cross-silo imports) gives one stdout hash and one stderr hash across 1/4/8 workers x cold/warm/no-cache.
• Fingerprint stability: 1.2.0 vs this branch on that fixture - identical finding sets, zero fingerprints changed.