refactor(scanner): type the worker path and align app-test results

Move the worker scanner surface into TypeScript, add a direct worker regression, and make the version=2 app-test path populate the same visible result data and final status as the legacy scanner. This keeps the refactor bounded while making the worker route safe to exercise.

Constraint: Must preserve the existing Apple Silicon app-test behavior while changing the worker internals
Rejected: Flip production to the worker path immediately | still needs the normal deploy path and broader production soak
Confidence: medium
Scope-risk: moderate
Reversibility: clean
Directive: Keep the version=2 adapter using the shared finishFileScan path until the legacy scanner can be removed entirely
Tested: pnpm run typecheck; pnpm exec vitest run test/scanner/client.test.ts; pnpm run test:browser (original workspace); netlify build --context deploy-preview (original workspace)
Not-tested: Browser suite from the clean clone environment (local Astro dev server startup timed out there)

helpers/scanner/worker.ts

@@ -0,0 +1,72 @@
+/// <reference lib="webworker" />
+
+import {
+    AppScan,
+    type AppScanSnapshot,
+    type ScanFileLike,
+    type ScanMessage
+} from './scan'
+
+type WorkerRequest =
+    | {
+        options: {
+            file: ScanFileLike
+        }
+        status: 'start'
+    }
+    | {
+        status: string
+    }
+
+type WorkerResponse =
+    | ScanMessage
+    | {
+        error?: {
+            message?: string
+        }
+        message?: string
+        scan?: AppScanSnapshot
+        status: 'finished'
+    }
+
+const workerScope = self as unknown as DedicatedWorkerGlobalScope
+
+function isStartRequest ( request: WorkerRequest ): request is Extract<WorkerRequest, { status: 'start' }> {
+    return request.status === 'start'
+}
+
+workerScope.onmessage = async ( event: MessageEvent<WorkerRequest> ) => {
+    if ( !isStartRequest( event.data ) ) {
+        workerScope.postMessage( {
+            status: 'finished'
+        } satisfies WorkerResponse )
+        return
+    }
+
+    const { options } = event.data
+    const scan = new AppScan({
+        fileLoader: options.file,
+        messageReceiver: ( details ) => {
+            workerScope.postMessage( details satisfies WorkerResponse )
+        }
+    })
+
+    try {
+        await scan.start()
+
+        workerScope.postMessage( {
+            scan: scan.toSnapshot(),
+            status: 'finished'
+        } satisfies WorkerResponse )
+    } catch ( error ) {
+        const message = error instanceof Error ? error.message : String( error )
+
+        workerScope.postMessage( {
+            error: {
+                message
+            },
+            message: `🚫 Error: ${ message }`,
+            status: 'finished'
+        } satisfies WorkerResponse )
+    }
+}