fix(scan): emit POSIX separators in Windows inventory

[SAYUTIM]

Fixes #302.

Summary

• Pass --path-separator / to ripgrep when generating the shared in-scope inventory.
• Extend the inventory regression to exercise the shipped helper and bundled parser validation logic with a nested ignored tracked file.
• Verify repeated generation is byte-identical, with a POSIX-only producer control for literal backslash and colon filename characters.

Root cause

On Windows, ripgrep prints paths with the platform-native \ separator by default. The inventory helper preserved that output, while the existing parser rejects backslashes and expects repository-relative paths separated with /, causing setup validation to fail before discovery.

Selecting / at the producer aligns the generated representation with the existing parser without changing its validation rules.

Impact

The reproduced repository-wide Deep Scan inventory can pass bundled path validation on native Windows instead of being rejected for its separator representation before discovery.

Regression coverage

The focused regression invokes the shipped Python helper against a temporary repository, checks complete inventory rows, verifies the ignored nested file remains included, and passes the portable inventory through the bundled parser validation logic. It verifies repeated output is byte-identical and uses a separate POSIX producer control to confirm that literal backslash and colon filename characters are not rewritten.

The regression failed against the unmodified implementation, passed with the fix, failed again when only the production option was temporarily removed, and passed after restoration.

Verification

• bun test --timeout 30000 ./tests-ts/runtime.test.ts -t "generates canonical scoped security inventory paths" on native Windows — 1 passed, 109 filtered, 0 failed
• The same focused test in a Linux container — 1 passed, 109 filtered, 0 failed
• bun test --timeout 30000 ./tests-ts/runtime.test.ts on native Windows — 86 passed, 24 skipped, 0 failed
• corepack pnpm run types — passed
• corepack pnpm run format — passed
• corepack pnpm run build — passed
• python -m py_compile _bundled_plugin/scripts/generate_in_scope_files.py — passed
• corepack pnpm run check:package ../../dist/*.tgz under Git Bash — 198 entries and the installed package validated
• corepack pnpm run test:package — installed-package smoke test passed
• git diff --check — passed

Scope

This change does not modify repository-path validation, traversal or drive-prefix checks, Deep Scan orchestration, dependencies, lockfiles, or release configuration.

Remaining limitations

The local complete SDK run finished with 888 passed, 54 skipped, and 10 environment-only failures that reproduce on the untouched base: Windows symlink creation is unavailable, jq is absent from the local Git Bash environment, and one control-character filename fixture fails with the local Python/Windows combination. This PR is initially a draft pending the repository's cross-platform CI results.