Simplify standalone SourceHunt resume around work-item memoization

[auroter]

What this does

Adds --resume SESSION_ID to standalone legacy SourceHunt runs. A resumed run reuses hunter work that completed successfully, including work that completed with zero findings. Missing, interrupted, or corrupt work runs again.

The repository and hunt options must still match the original run, but the model, endpoint, credentials, output format, and later stages such as verification or exploitation can change.

How it works

Resume fits into the existing pipeline as a cache around WorkItem -> TargetResult; it is not a second workflow.

Preprocessing always runs and verifies that the selected source files have not changed. A valid completed rank plan is restored so the same work is scheduled. HunterPool gives each file/band/attempt/context combination a deterministic ID and loads an immutable completed result when one exists. Cached findings then go through the normal findings-pool and promotion paths, while verification, exploitation, enrichment, and reporting run normally.

The existing spend ledger is reopened so the budget remains a lifetime session cap, and a session lock prevents concurrent writers. Campaign-owned and proof-flow runs keep their existing orchestration and are not supported by this resume path.

Testing

Run the focused and SourceHunt suites:

pytest -q tests/test_sourcehunt_resume.py tests/test_findings_pool.py tests/test_sourcehunt_runner.py
pytest -q tests -k sourcehunt --ignore=tests/test_sourcehunt_webhook_server.py
ruff check clearwing/llm/budget.py clearwing/sourcehunt/findings_pool.py clearwing/sourcehunt/pool.py clearwing/sourcehunt/resume.py clearwing/sourcehunt/runner.py clearwing/ui/commands/sourcehunt.py tests/test_sourcehunt_resume.py

To test the behavior manually, start a small run and interrupt it after at least one file finishes:

clearwing sourcehunt ./repo \
  --output-dir ./results/sourcehunt \
  --max-parallel 1 \
  --no-verify --no-exploit

Then repeat the same repository and hunt options with the printed session ID:

clearwing sourcehunt ./repo \
  --output-dir ./results/sourcehunt \
  --max-parallel 1 \
  --no-verify --no-exploit \
  --resume sh-xxxxxxxx

The resumed run should log cache reuse for completed files, rerun only unfinished work, preserve existing work-results files, and continue from the prior lifetime spend.