v0.4.0: Intel-powered scanning — fail-loud data handling, signed compressed snapshots, mirrors

[TambetPaljasma]

• Dockerfile could not build (§1.1). It copied app/defaults and
  templater/templates; both moved under internal/ and are go:embed-ed, so
  BuildKit failed on missing sources. Removed, along with the now-wrong
  ENV CODEWARD_TEMPLATES_PATH — that variable is an override, not a default.
• Every released build reported dev (§1.2). Neither the Dockerfile nor
  build-binaries.yaml injected the version ldflags, so main.Version — which
  is forwarded into every Intel query as ScannerVersion and into contribution
  attribution — made every scanner in the world look like the same unreleased
  build. Now injected in both, plus git describe in the Makefile.
• go.mod committed a replace to ../codeward-common — not in the plan.
  A clean single-repo checkout, which is exactly what the Docker build and
  build-binaries.yaml do, failed module resolution before compiling a line.
  No release artifact could have been produced. Removed and pinned.
• Silent no-data pass (§1.3), as above. API failure now falls through to the
  snapshot path (downloading, not cache-only — the query endpoint and the static
  segment endpoints fail independently). Adds scanner.IntelStatus carrying
  source/degraded/reason/watermark, --intel-required (default true), a
  warning banner in PR comments, and 429 + Retry-After handling.
• Signature-verification bypass. Once a bad signature aborted the snapshot
  path, the caller answered that error by falling through to a legacy downloader
  with no signature check, against the same host. Anyone able to serve a bad
  manifest could get their database trusted by failing verification on purpose.
  The legacy OfflineDB path is deleted (§1.7).
• Snapshot cache ignored the mounted directory. With CODEWARD_CACHE_DIR
  unset it resolved to the relative intel-snapshots; in the container that is
  /, which the scan user cannot write. The documented -v ...:/tmp/.cache
  mount and the action's cache step were both writing where nothing read. Found
  by running the image.
• Read-only snapshot cache crashed the scanner — a nil-pointer panic in
  reflect because SQLite wanted lock state beside a file it could not write and
  returned malformed rows. immutable=1 on the DSN; :ro is the documented
  air-gapped setup.