Base-scan cache does not distinguish reader changes within the same package version

[pengfei-threemoonslab]

Problem

While implementing #557 at main 47de37034, _cache_report_path in cli/verify/orchestrator.py was found to key a base scan by BASE_CACHE_KEY_EPOCH, package version, base tree, configuration and scan options. It does not bind the engine distribution or reader implementation identity. A source-checkout reader change that keeps __version__ unchanged can therefore reuse an earlier report that never collected its new evidence. Advancing the manual epoch invalidates known old results but does not establish a general cache contract.

Proposed direction

Bind cached scan provenance to the reader/engine that actually produced the report, with a validated migration path for old entries. Reuse the existing engine identity where practical and account for its cost once per invocation. Do not trust a report's claimed version alone or treat missing new evidence as evidence of absence.

Acceptance

• A reader implementation change at the same package version cannot reuse an incompatible cached base report.
• Equivalent repeated runs still reuse the cache deterministically.
• Old, corrupt and mismatched cache records regenerate safely and have actionable diagnostics.
• Integration coverage exercises actual base-report reuse and invalidation, including installed and source-checkout engines.

Sequencing

Deferred follow-up from #557. That work must invalidate known prior base evidence for its new reader before comparison; this issue owns the broader automatic engine-identity cache contract. Existing #430 archive-size work and #298's delivered CI-policy preservation address different failures.