Add --ignore-dirty-worktree to reuse recent scans of dirty worktrees

[Ibrahimrahhal]

Summary

• Add --ignore-dirty-worktree, which can only be used with --skip-if-commit-scanned-recently.
• When a recent scan of the same commit exists, reuse it even if this worktree is dirty or the prior scan recorded worktree_dirty.
• New scans still send the real dirty status; the flag only changes reuse, not the upload label.

Test plan

• corgea scan --ignore-dirty-worktree without --skip-if-commit-scanned-recently is rejected
• Dirty worktree + skip-recent still starts a new scan (existing behavior)
• Dirty worktree + skip-recent + --ignore-dirty-worktree reuses a recent scan of the commit
• Prior scan with worktree_dirty=true is reused when the flag is set
• When nothing is reusable, a new scan still uploads dirty=true and prints the uncommitted-changes notice
• cargo test --test cloud_commands_e2e ignore_dirty

Made with Cursor

[corgea-security]

Automated review risk: 4/5.

The override can reuse legacy scans whose scope is unknown, potentially treating a partial scan as a complete commit scan and missing findings.

Critical or high-priority changes must be addressed.

Automatic approval was not submitted: checks failed: Build and Upload Native Binaries (windows-latest, x86_64-pc-windows-msvc, corgea.exe), windows (windows-latest, x64).

[corgea-security]

high: Dirty prior scans cannot safely represent the commit

Accepting worktree_dirty == Some(true) means the scan's uploaded source may differ arbitrarily from its recorded SHA. For example, a prior dirty worktree can delete a vulnerable file from commit C and produce clean results; a later invocation for C then reuses those results and allows --block-on to exit successfully without ever analyzing the vulnerable committed file. The dirty flag provides no proof that the differences were harmless. Keep prior candidates restricted to Some(false); ignoring the current worktree's dirtiness is a separate explicit decision.

Proof or reproduction:

let mut prior = scan("prior", "complete", Some(SHA), "2026-01-01T23:00:00Z");
prior.worktree_dirty = Some(true);
// The prior upload may omit vulnerable content present in SHA.
assert!(select_reusable_scan(&[prior], SHA, now(), DAY, true).is_none());

[Ibrahimrahhal]

This is expectected

[corgea-security]

Automated review risk: 4/5.

The override can reuse results from arbitrary uncommitted content, making security gates report false success for the requested commit.

Critical or high-priority changes must be addressed.

Automatic approval was not submitted: automated review found critical or high-priority findings.

[yhoztak]

LGTM