Preserve comparison and scan identities

[John-David Dalton (jdalton)]

Preserve the server comparison ID and both full-scan IDs so report consumers can distinguish a comparison from its scans.

Root Cause

The CLI discarded the server diff ID after fetching artifacts. Full-scan results also omitted the new scan ID.

Fix

• Retain comparison and scan IDs through package processing and alert selection.
• Preserve the existing Diff.id, public return values and standard JSON fields.
• Leave the comparison ID absent when streaming fallback supplies the result.
• Add a reusable local HTTP fixture that exercises the real CLI core and SDK.

Builds on #396. This change does not publish a release.

Validation

All 22 focused identity and HTTP transport tests pass, including a valid findings stream and final fallback identities. Scoped Ruff passes. The legacy polling suite remains unverified because the available environment lacks its mocker fixture.

Public Changelog

Preserve comparison and full-scan identities in Python CLI results.

---

Note

Medium Risk
Touches core diff/comparison plumbing and identity semantics used across CI outputs, though public tuple APIs and standard JSON fields stay backward compatible; incorrect ID propagation could mislink dashboards or downstream automation.

Overview
Preserves server comparison and baseline scan IDs through the Python CLI diff pipeline so consumers can tell apart the diff-scan resource, the new full scan, and the baseline scan.

The Diff model gains optional old_scan_id and diff_scan_id (with new_scan_id nullable for no-op runs) and a set_scan_ids() helper that keeps Diff.id aligned with the new scan. Diff polling now returns a DiffScanResult / PackageComparisonResult that carries the API’s diff_scan_id; legacy get_diff_scan_artifacts and get_added_and_removed_packages wrappers are unchanged. create_new_diff and full-scan flows populate all three IDs when the diff-scans path succeeds; streaming fallback leaves diff_scan_id unset so abandoned server IDs are not surfaced.

Alert cloning copies the new identity fields. Standard JSON output shape is unchanged (full_scan_id still maps to diff.id). Release 2.10.12 plus integration tests against a local HTTP fixture exercise real SDK transport for primary diff-scans, duplicate resolution, and fallback behavior.

^{Reviewed by Cursor Bugbot for commit ef00228. Configure here.}