feat: add findings.filter.delta workflow for line-range delta filtering

[mattdolan-snyk]

What

Adds findings.filter.delta — a product-agnostic line-range delta filter operating on the GAF workflow layer. Given explicit changed files + line ranges, returns only findings whose location intersects changed lines. Handles both LOCAL_FINDING_MODEL (Snyk Code) and UFM_RESULT (Secrets) content types so both products are covered without any changes to their extensions.

Why

Brings the line-granularity filtering currently done in the Secure At Inception Claude Code hook into the CLI as a reusable primitive. File granularity already exists via code-client-go changedFiles/limitToFiles; this adds the line layer. Any finding-producing product (SAST, Secrets, …) gets "only show me what I changed" without product-specific code.

Contract

Explicit JSON input (--changed-lines-file / --changed-lines), no git. Schema v1:

{
  "version": 1,
  "files": {
    "src/app.py":      [{ "start": 10, "end": 24 }, { "start": 80, "end": 80 }],
    "src/new_file.py": "all"
  }
}

Fail behaviour (split by case):

• Absent input → no-op pass-through (normal full scan, identical to today)
• Malformed input → fail closed (catalog error, non-zero exit, no misleading clean result)
• Empty files: {} → fail closed ("omit the flag for a full scan")

Finding with file in scope but no line data → kept (false positive beats false negative for a security gate).

Files changed

File	Purpose
internal/utils/findings/delta.go	Core: ParseChangedScope, NormalizeRelPath, mergeRanges, ChangedScope, GetDeltaFilter (LocalFinding adapter)
internal/utils/findings/delta_test.go	30+ table-driven tests: parse/validate, merge-ranges, path normalisation, intersection, GetDeltaFilter edge cases
pkg/local_workflows/delta_filter_workflow.go	findings.filter.delta workflow; dispatches on content type; UFM adapter via filteredTestResult wrapper
pkg/local_workflows/delta_filter_workflow_test.go	Workflow-level tests using real juice-shop SARIF fixture
pkg/configuration/constants.go	FLAG_CHANGED_LINES_FILE, FLAG_CHANGED_LINES constants
pkg/local_workflows/local_workflows.go	Registers InitDeltaFilterFindingsWorkflow

Tests

• go test ./internal/utils/findings/ — all pass (intersection-not-containment, multi-range, "all" sentinel, path normalisation, malformed input enumeration)
• go test ./pkg/local_workflows/ — all pass (registration, no-flag pass-through, line filter, file not in scope, malformed fail-closed, summary recomputed)

Known follow-ups

• UFM summary counts — after delta filtering UFM findings, EffectiveSummary/RawSummary on the TestResult still reflect pre-filter counts. For snyk secrets test --json consumers the count fields will be stale. Fixing requires a summary-update path on the TestResult interface or post-filter reconstruction.
• CLI wiring — companion PR in the CLI repo inserts this workflow into runWorkflowAndProcessData between the severity filter and output workflow.

Companion PR

CLI PR wires this workflow into the command chain for snyk code test and snyk secrets test (both share runWorkflowAndProcessData).

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues
✅	Secrets	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.