fix: copy the full finding set when reusing a cached scan for the deploy gate (#1476)

The pre-deploy gate reuses a cached scan for the same image digest within 24h.
The cache-hit path copied only the first 1000 detail rows while keeping the
cached scan's full aggregate total, so the persisted preflight scan stored fewer
detail rows than its total_vulnerabilities. The gate's integrity check in
evaluateImageRisk treats that mismatch as untrustworthy and fails closed on every
active KEV or fixable input, blocking a deploy with no actual matching finding
and bypassing honored suppressions.

The cache-hit copy now reads the complete detail set (getAllVulnerabilityDetails)
so the persisted scan keeps stored details equal to total_vulnerabilities,
matching a fresh scan and letting the gate evaluate the real findings.

backend/src/services/TrivyService.ts

@@ -651,7 +651,11 @@ class TrivyService {
                         `scanImage: cache hit for digest=${digest} scanId=${cached.id} ageMs=${startedAt - cached.scanned_at}`,
                     );
                     const db = DatabaseService.getInstance();
-                    const details = db.getVulnerabilityDetails(cached.id, { limit: 1000 }).items;
+                    // Copy the cached scan's full finding set, not a truncated page:
+                    // the persisted copy must keep stored details == total_vulnerabilities,
+                    // or the deploy gate's integrity check fails closed on a cached scan
+                    // that has more findings than a single detail page would hold.
+                    const details = db.getAllVulnerabilityDetails(cached.id);
                     const cachedSecrets = scanners.includes('secret')
                         ? db.getSecretFindings(cached.id, { limit: 1000 }).items
                         : [];