feat(utils): add shared scanner package with MCP runner and RunAll orchestrator

[paralta]

The dir-importer had all security scanning logic isolated within its own packages, making it impossible for the reconciler to reuse it without duplication. This PR introduces utils/scanner as the shared home for scanner interfaces and runner implementations, so both the importer (companion PR in dir-importer to follow) and the upcoming reconciler scan task can call into the same code.

The package exposes three things: a Runner interface that any scanner CLI wrapper implements; a RunAll function that executes all registered runners against a *corev1.Record, merges results, and returns a single ScanResult; and MCPRunner, the first concrete runner, which clones the record's source repository and invokes mcp-scanner behavioral --raw to detect malicious MCP server behaviours. Tests cover both the merge logic and RunAll's error-handling contracts (partial failure, all-fail, no runners).

• Runner takes *corev1.Record directly rather than an intermediate input type, which required adding github.com/agntcy/dir/api as a dependency of utils/. This is intentional — utils/ is released in lockstep with api/, so the coupling is expected.
• RunAll returns an error only when all runners fail; a partial failure is logged and skipped so a transient scanner outage does not silently reject records downstream.
• merge is unexported; RunAll is the only public entry point for orchestration, keeping the surface area minimal for callers.

[codecov]

Codecov Report

❌ Patch coverage is 69.64286% with 51 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
utils/scanner/mcp.go	57.9%	51 Missing ⚠️

📢 Thoughts on this report? Let us know!