Treat findings memory as per-scan scratch

[bakayolo]

Summary

• clear worker-local findings at the start of each orchestrator scan and after successful snapshot persistence
• use a singleton orchestrator workflow ID for manual and scheduled scans so overlapping scans are rejected/skipped
• return HTTP 409 when a manual scan is triggered while another scan is already running

Verification

• go test ./pkg/store/memory ./pkg/workflow/orchestrator ./pkg/scan ./pkg/schedule
• make test
• docker compose full scan with real Wiz creds from .env:
  • first POST /scan returned 202 for workflow version-guard-active-scan
  • immediate second POST /scan returned 409 Conflict
  • scan completed and persisted snapshot 86448667-4a76-4a80-9931-1858bc084bdf with 28,232 findings across 10 resource types
  • logs confirmed scan-start clear and post-snapshot clear

[bakayolo]

Closing in favor of #86. I’m moving the single-scan safeguards onto #86 so we keep the safer per-resource-type eviction fix plus the collector-level overlap protection.