feat: PR delta scanning — API core, scanner cmds, client, ChangedFiles threading

[ant-gferreira]

Delta Scanning Implementation — API Side

Implements PR delta scanning: scanners clone only changed files instead of entire repository.

Changes (4 commits, 10 files, +573/-84)

Phase 1 — API Core (892f1de):

• api/types/types.go: Added ChangedFiles field to Repository
• api/util/util.go: Added %CHANGED_FILES% placeholder to HandleCmd
• api/kubernetes/huskykube.go: Added getScannerConfig(), isDeltaScanEnabled()
• api/kubernetes/api.go: Conditional HUSKYCI_DELTA_SCAN=true env var on pods

Phase 2 — Scanner Cmd Scripts (3df89db):

• api/config.yaml: Sparse-checkout conditional for 7 delta-capable scanners (gitleaks, gosec, bandit, brakeman, wizcli_secrets/iac/sast)

Phase 3 — Client Pipeline (ee7ae31):

• client/config/config.go: Reads HUSKYCI_CLIENT_CHANGED_FILES env var
• client/types/types.go: Added ChangedFiles to JSONPayload
• client/analysis/analysis.go: Sends ChangedFiles in request payload

Phase 3.5 — API Threading (b3beb25):

• Threads ChangedFiles from JSON → Repository → StartAnalysis → SecTestScanInfo → HandleCmd

Tests

• 151/151 tests pass (17 packages)
• New tests: handlecmd_delta_test.go (4), huskykube_test.go (8), analysis_test.go (2)

Related

• Spec: docs/superpowers/specs/2026-06-09-huskyci-delta-scanning-design.md
• Plan: docs/plans/2026-06-09-delta-scanning-implementation.md