fix: preserve review state and detector verification scope

[eminos]

Summary

review --run-batches --state .desloppify/custom/state-typescript.json --scan-after-import imports into the named state but launches the follow-up against the default state. Review-only merges also stamp accepted mechanical findings as scan-verified absent when their detector has no open rows.

 review import
-  follow-up scan uses the default state
+  follow-up scan uses the imported state and runtime project root

 review-only merge
-  absent detector groups with no open rows gain scan verification
+  protect every detector outside the current merge inventory

Pass the imported state through batch execution, import-run replay and external submit. Resolve the path before changing subprocess working directory. When accepted debt appears again, clear stale scan verification fields while retaining its manual status, reason and attestation.

Evidence

• Before: 19 regression cases failed on unchanged upstream, plus two cases reproduced stale verification on redetected accepted debt. After: 137 focused tests pass. Fixtures cover both review import paths, all three manual dispositions, nested state paths, relative paths, changed subprocess working directories and each follow-up entry point.
• Full suite on base 3a7735d5: 5741 passed, 70 failed, 4 skipped. Patched suite: 5763 passed, the exact same 70 failed test IDs, 4 skipped. No added suite failures.
• Both new test modules pass Ruff. Four preexisting import-order diagnostics are identical on the base and changed production files; all other selected Ruff checks pass.
• An ordinary follow-up scan and immediate next passed against an isolated source-only project snapshot using the previously patched tool plus these changes. The named state advanced from scan_count 0 to 1 while the default-state sentinel stayed byte-exact at 0. No queue bypass was used. PHPStan/parser_error and jscpd errors remain mechanical coverage gaps. No application source or private scanner state is included in this PR.

Merge Danger

Door: two-way

Blast Radius: review

Explicit follow-up state paths and detector-scoped resolution verification change. Queue bypass flags, import counters and manual debt decisions retain their existing behavior.