fix scan isolation and review workflow consistency

[iam10k]

Several queue and scan paths disagreed with the configured project state. These changes make language scans use their own runtime and discover supported test extensions, keep plan display and resolve enforcement on the same configured subjective threshold, and validate trusted review imports against the selected dimensions. Triage counts only review findings, and weighted coverage is labeled as potential. Completed triage with no open review findings now prunes a stale create-plan prompt while keeping mechanical work executable; initial and partial planning remain supported.

TypeScript JSON.parse guard detection now recognizes same-line try/catch protection and handles strings and nested arrow functions without misclassifying guarded calls.

Validation: 6,843 passed, 17 skipped with /private/tmp/house-desloppify-venv/bin/python -m pytest -q (6,860 collected across the configured test paths). The 62 focused queue and resolve tests pass. Ruff passes on the queue/guard modules and their regression test.

The stale workflow regression suites pass (133 tests), and full Ruff passes across the five touched workflow and test modules.

First-scan review IDs also remain executable after reconciliation seeds the initial score baseline, instead of incorrectly surfacing a second scan. A full lifecycle regression covers that sequence.

Autofix suggestions now match a finding’s subtype: hardcoded URL and other manual smell findings no longer advertise the dead-useEffect fixer, and batch hints count only compatible findings. Regressions also cover unknown detectors.

Skipped stale subjective refreshes are filtered before lifecycle phase selection, so they cannot hide real planned work or a pending scan and incorrectly report an empty execution queue. Two generic regression tests cover both cases; the focused queue/lifecycle suites pass (25 tests).