feat(05-05): wire --verify into scan pipeline with consent gate
- Add --verify-timeout (default 10s) and --verify-workers (default 10) flags
- Refactor scan loop to collect findings, verify, then persist
- Gate verification behind verify.EnsureConsent(db, stdin, stderr)
- Route findings through verify.HTTPVerifier.VerifyAll with configurable
timeout and worker pool, back-assign Result.Status/HTTPCode/Metadata
onto engine.Finding by provider+masked-key tuple
- Persist verify_* columns via storage.SaveFinding after verification
6fc0abe8ae