fix: Preserve Semgrep context in diff-only scans

[julio-rocketchat]

Summary

Semgrep now parses complete selected HEAD files in both scan modes. The existing worker post-filter still restricts diff-only reporting to changed lines. Trufflehog continues to receive projected hunks.

Why

Removing enclosing syntax before Semgrep runs can hide matches that depend on function context or dataflow.

Verification

• Node 22: build, typecheck, lint, configuration validation, and all 620 tests passed.
• Added a dispatcher regression with different repository and projected-workspace paths.
• Ran an ephemeral real-Semgrep test: a synthetic rule matched a changed eval call inside its function, but not the projected snippet. Temporary fixtures were removed.
• Security review covered scanner scope, changed-line filtering, and workspace routing. Gitleaks staged-patch scan passed.

Related but distinct from #80, which addresses annotation end lines.

[julio-rocketchat]

CI follow-up: the shared install failure was reproduced in an isolated Node 22 container. With maintainer approval, this branch now uses npm ci instead of deleting the lockfile and resolving a fresh dependency graph. This is the only CI change; GitHub checks are rerunning.