[BUG] claude-security scan-changes reproducibly analyzes wrong diff content

### Preflight Checklist

- [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Abug) and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code

### What's Wrong?

Follow-up to a previously drafted report on the same bug. Retried the scan-changes job (claude-security plugin) a second time, with a brand-new report directory and a brand-new Workflow run id (wf_73cca42c-76f, vs the first attempt's wf_326ad394-df4) -- ruling out simple per-run agent-cache replay as the cause.

Same wrong result both times: the inventory/research step reported analyzing .github/workflows/unit-tests.yml / instrumented-tests.yml, fabricating a placeholder Firebase google-services.json, and explicitly stated that the :base module "is unchanged by this commit range" -- both false for the actual range.

Verified before and after the retry that local git state exactly matches the GitHub remote (git rev-parse origin/master/HEAD == gh api .../branches/master|development .commit.sha), and confirmed via plain `git diff --numstat ..` that the real diff is 18 files / 750 lines touching base/build.gradle, MainActivity.kt, BaseViewModel.kt, and several test files added/removed -- nothing under .github/workflows changed at all in this range.

Evidence:
- First attempt: run dir CLAUDE-SECURITY-20260905-084249 / workflow run wf_326ad394-df4
- Second (retry) attempt: run dir CLAUDE-SECURITY-20260905-092735 / workflow run wf_73cca42c-76f
- Both scan-meta.json correctly recorded revision.merge_base=6073fdf8129ff75286743b1df20d2379c57254c4, revision.commit=0e7aa99ad5662f854059b70e059da0bb0aafe325
- Repo: github.com/carlosblagdev/contracciones_cronometradas_kotlin (private)

Suspected cause (not fully root-caused): ruled out stale local/remote git state and simple agent-result cache collision within one workflow run (fresh run id on retry gave the identical wrong result). Suspect the diff/range is being resolved or read via some path other than the exact two-sided range handed to Workflow(args.range), possibly picking up a different commit's content by file-path/theme similarity rather than the literal git range.

### What Should Happen?

The scan-changes job should analyze the exact diff between the two commits/refs passed to Workflow(args.range) -- no more, no less. Concretely:

- Inventory/hotFiles should list only files that actually appear in `git diff --numstat ..` for the requested range (here: base/build.gradle, MainActivity.kt, BaseViewModel.kt, and the added/removed test files).
- It should never surface content from files unrelated to the range (.github/workflows/unit-tests.yml, instrumented-tests.yml) just because a similarly-themed commit touching those files exists elsewhere in the repo's history.
- The :base module change-detection should correctly report "changed" whenever the requested range touches files under :base (it did here, and was wrongly reported as unchanged).
- Running the same range twice, with fresh run ids, should produce the same correct result each time -- not the same wrong one.

### Error Messages/Logs

```shell
scan-meta.json (both runs) correctly recorded:
revision.merge_base=6073fdf8129ff75286743b1df20d2379c57254c4
revision.commit=0e7aa99ad5662f854059b70e059da0bb0aafe325

Run dirs:
CLAUDE-SECURITY-20260905-084249 / workflow run wf_326ad394-df4 (1st attempt)
CLAUDE-SECURITY-20260905-092735 / workflow run wf_73cca42c-76f (2nd attempt, retry)
```

### Steps to Reproduce

1. In a repo where some other branch/PR history contains a commit touching CI YAML with a similarly-themed "generate dummy google-services.json" step, run the claude-security scan-changes job against an unrelated commit range that does NOT include that commit.
2. Observe the inventory/research step's component list and hotFiles.
3. It keeps citing that unrelated CI YAML content and fabricated google-services.json details regardless of the actual requested range, and misreports whether the :base module changed.
4. Retry with a fresh Workflow run id against the same range -- the wrong result reproduces identically.

### Claude Model

None

### Is this a regression?

Yes, this worked in a previous version

### Last Working Version

_No response_

### Claude Code Version

2.1.259 (Claude Code)

### Platform

Anthropic API

### Operating System

Windows

### Terminal/Shell

PowerShell

### Additional Information

Repo: github.com/carlosblagdev/contracciones_cronometradas_kotlin (private repo). Area: claude-security plugin, scan-changes job.

Start with the claude-security scan-changes job and the Workflow(args.range) path, then compare its range handling with git diff --numstat between the merge base and commit recorded in scan-meta.json. Reproduce the issue using the two recorded revisions and inspect inventory/hotFiles and :base change detection. Done means only files in the requested range are reported and repeated runs produce the same correct result.

Vom Indexierungsmodell aus dem Issue-Text verfasst.