feat(01-04): add shared Chunk type, Finding struct, Shannon entropy, and MaskKey

- pkg/types/chunk.go: shared Chunk struct breaking engine<->sources circular import
- pkg/engine/finding.go: Finding struct with MaskKey for pipeline output
- pkg/engine/entropy.go: Shannon entropy function using math.Log2
- pkg/engine/entropy_test.go: TDD tests for Shannon and MaskKey

pkg/engine/finding.go

@@ -0,0 +1,26 @@
+package engine
+
+import "time"
+
+// Finding represents a detected API key from the scanning pipeline.
+// KeyValue holds the plaintext key -- the storage layer encrypts it before persisting.
+type Finding struct {
+	ProviderName string
+	KeyValue     string // full plaintext key
+	KeyMasked    string // first8...last4
+	Confidence   string // "high", "medium", "low"
+	Source       string // file path or description
+	SourceType   string // "file", "dir", "git", "stdin", "url"
+	LineNumber   int
+	Offset       int64
+	DetectedAt   time.Time
+}
+
+// MaskKey returns a masked representation: first 8 chars + "..." + last 4 chars.
+// Returns "****" if the key is shorter than 12 characters.
+func MaskKey(key string) string {
+	if len(key) < 12 {
+		return "****"
+	}
+	return key[:8] + "..." + key[len(key)-4:]
+}