[BUG] claude-security scan-changes reproducibly analyzes wrong diff content

### Preflight Checklist

- [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Abug) and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code

### What's Wrong?

Follow-up to a previously drafted report on the same bug. Retried the scan-changes job (claude-security plugin) a second time, with a brand-new report directory and a brand-new Workflow run id (wf_73cca42c-76f, vs the first attempt's wf_326ad394-df4) -- ruling out simple per-run agent-cache replay as the cause.

Same wrong result both times: the inventory/research step reported analyzing .github/workflows/unit-tests.yml / instrumented-tests.yml, fabricating a placeholder Firebase google-services.json, and explicitly stated that the :base module "is unchanged by this commit range" -- both false for the actual range.

Verified before and after the retry that local git state exactly matches the GitHub remote (git rev-parse origin/master/HEAD == gh api .../branches/master|development .commit.sha), and confirmed via plain `git diff --numstat ..` that the real diff is 18 files / 750 lines touching base/build.gradle, MainActivity.kt, BaseViewModel.kt, and several test files added/removed -- nothing under .github/workflows changed at all in this range.

Evidence:
- First attempt: run dir CLAUDE-SECURITY-20260905-084249 / workflow run wf_326ad394-df4
- Second (retry) attempt: run dir CLAUDE-SECURITY-20260905-092735 / workflow run wf_73cca42c-76f
- Both scan-meta.json correctly recorded revision.merge_base=6073fdf8129ff75286743b1df20d2379c57254c4, revision.commit=0e7aa99ad5662f854059b70e059da0bb0aafe325
- Repo: github.com/carlosblagdev/contracciones_cronometradas_kotlin (private)

Suspected cause (not fully root-caused): ruled out stale local/remote git state and simple agent-result cache collision within one workflow run (fresh run id on retry gave the identical wrong result). Suspect the diff/range is being resolved or read via some path other than the exact two-sided range handed to Workflow(args.range), possibly picking up a different commit's content by file-path/theme similarity rather than the literal git range.

### What Should Happen?

The scan-changes job should analyze the exact diff between the two commits/refs passed to Workflow(args.range) -- no more, no less. Concretely:

- Inventory/hotFiles should list only files that actually appear in `git diff --numstat ..` for the requested range (here: base/build.gradle, MainActivity.kt, BaseViewModel.kt, and the added/removed test files).
- It should never surface content from files unrelated to the range (.github/workflows/unit-tests.yml, instrumented-tests.yml) just because a similarly-themed commit touching those files exists elsewhere in the repo's history.
- The :base module change-detection should correctly report "changed" whenever the requested range touches files under :base (it did here, and was wrongly reported as unchanged).
- Running the same range twice, with fresh run ids, should produce the same correct result each time -- not the same wrong one.

### Error Messages/Logs

```shell
scan-meta.json (both runs) correctly recorded:
revision.merge_base=6073fdf8129ff75286743b1df20d2379c57254c4
revision.commit=0e7aa99ad5662f854059b70e059da0bb0aafe325

Run dirs:
CLAUDE-SECURITY-20260905-084249 / workflow run wf_326ad394-df4 (1st attempt)
CLAUDE-SECURITY-20260905-092735 / workflow run wf_73cca42c-76f (2nd attempt, retry)
```

### Steps to Reproduce

1. In a repo where some other branch/PR history contains a commit touching CI YAML with a similarly-themed "generate dummy google-services.json" step, run the claude-security scan-changes job against an unrelated commit range that does NOT include that commit.
2. Observe the inventory/research step's component list and hotFiles.
3. It keeps citing that unrelated CI YAML content and fabricated google-services.json details regardless of the actual requested range, and misreports whether the :base module changed.
4. Retry with a fresh Workflow run id against the same range -- the wrong result reproduces identically.

### Claude Model

None

### Is this a regression?

Yes, this worked in a previous version

### Last Working Version

_No response_

### Claude Code Version

2.1.259 (Claude Code)

### Platform

Anthropic API

### Operating System

Windows

### Terminal/Shell

PowerShell

### Additional Information

Repo: github.com/carlosblagdev/contracciones_cronometradas_kotlin (private repo). Area: claude-security plugin, scan-changes job.

Start with the claude-security scan-changes job and the Workflow(args.range) path, then compare its range handling with git diff --numstat between the merge base and commit recorded in scan-meta.json. Reproduce the issue using the two recorded revisions and inspect inventory/hotFiles and :base change detection. Done means only files in the requested range are reported and repeated runs produce the same correct result.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.