refactor(app): share scan pipeline between cli and workflow

[mstykow]

Summary

• add a shared internal app-layer scan pipeline so the CLI and library workflow facade execute through the same request, planning, runtime, and output path
• add a public workflow embedding facade plus a concise docs/LIBRARY_GUIDE.md for supported Rust library usage today
• fix multi-input absolute path handling, add workflow doctests, and restore doctest verification in CI

Issues

• Covers: Create provenant serve API #834

Scope and exclusions

• Included:
  • shared internal scan orchestration for CLI and library entry points
  • public workflow::{scan_path, scan_paths} embedding surface
  • library guide and README/docs index discoverability updates
  • absolute multi-input path fix for shared native scan selection
  • workflow doctests and CI doctest verification
• Explicit exclusions:
  • provenant serve
  • any HTTP API or long-lived service mode
  • closing Create provenant serve API #834 end-to-end

Intentional differences from Python

• expose a first-class Rust workflow facade while still reusing the same ScanCode-compatible internal output pipeline used by the CLI

Follow-up work

• Created or intentionally deferred:
  • Create provenant serve API #834 remains open for future serve/API design and broader library-surface follow-up
  • CLI guide wording and a dedicated CLI regression around absolute multi-input scans can follow separately if we want stronger user-facing coverage there

Expected-output fixture changes

• Files changed: none
• Why the new expected output is correct: no golden or expected-output fixtures changed; behavior changes were validated with unit tests, doctests, clippy, final review passes, and CLI smoke coverage