[codex] Reuse pre-scan bundle for interfile scans

[mfow-nullify]

What changed

• reuse the pre-scan rule-to-target plan inside a single CLI invocation so the actual interfile scan can consume the warmed bundle from memory instead of recomputing it
• include bypass_includes_excludes_for_files in the warmed-plan path so the status phase and scan phase use the same targeting inputs
• add unit coverage for in-memory plan reuse, cache-key separation, and the interfile scan path reusing the pre-scan bundle

Why

Interfile taint scans were paying the planning/bundling cost twice: once while printing scan status and again before invoking the engine. Bundling first fixes the slow scan behavior the user reported, so this change makes the scan reuse that work automatically and keeps it in memory instead of writing a separate bundle artifact.

Validation

• . cli/.venv/bin/activate && pytest -n 0 -vv --tb=short cli/tests/default/unit