fix: avoid repeated work in secret scanning

[svozza]

Large minified files make secret scanning repeatedly search an entire line for every entropy candidate. A pinned 350 KB public SVG took 95.98 seconds to scan; this change scans it in 0.59 seconds with the same detection result.

The scanner now indexes quoted values once, scans repeated identical lines once per file, and reuses results for matching content and filenames within the existing review entry point. The cache retains digests and candidate results, is bounded by entry count and candidate-text size, and clears on success or failure. Changed contents are scanned again; every secret occurrence is still redacted.

Includes the evaluation-grader fix from #77: relative paths and pathless Grep/Glob searches resolve against the reviewer's fixed BASE working directory. CI run 36127246440 correctly found the caller-impact defect but failed because the grader discarded its pathless search. The original transcript passes the corrected grader with unchanged scenario expectations; a regression test also checks that reading only the PR-head caller still fails.

Validation:

• 2,356 tests passed, including adversarial and generated equivalence checks; 2 skipped.
• Type checking passed.
• The affected caller-investigation scenario passed 3/3 fresh Bedrock Opus 4.8 runs.
• CI run 36128379004 passed all 42 review and 6 remediation evaluations, with no API errors.
• Added review-entry-point tests for reuse, separate invocations, failure and exception cleanup.
• Added a reproducible public SVG benchmark to docs/testing.md.