RG-23: Approved scanner and redaction workflow

[hedhoud]

Context

A scanner contract becomes operational only after the organization selects an approved scanner and handling policy.

Problem

Sensitive content cannot safely move through pass, redaction, quarantine, and human-review decisions without preserving version lineage.

Expected behavior

• The selected scanner follows the approved handling policy.
• Quarantined findings require the appropriate review.
• Redaction creates a derived source version linked to the original.
• Scanner failures never silently approve content.
• Pilot cases produce the expected pass, redact, or quarantine outcome.

Delivery dependency: RG-22 and an organizational scanner decision.