COR-1766: report dirty worktree state with corgea scan uploads

[leenk7991]

Summary

• Report worktree dirty state on BLAST uploads (dirty=true|false next to sha) so doghouse can skip commit-diff incremental scans.
• Print a short notice when scanning uncommitted local files.
• Status check failures fail safe to dirty; detect after packaging so the flag matches the archive.
• pairs with https://github.com/Corgea/doghouse/pull/1838

Test plan

• ./harness check
• Clean tree: corgea scan — no dirty notice; multipart dirty=false
• Edit tracked file, rescan same SHA — dirty notice + dirty=true; with COR-1765, full scan (not stale copy)
• Gitignored-only file — no dirty notice
• Confirm COR-1765 deployed before release

[corgea-security]

Automated review risk: 4/5.

The new dirty flag can incorrectly identify partial or inconsistent archives as clean HEAD snapshots, making incremental scan results unsound.

Critical or high-priority changes must be addressed.

Automatic approval was not submitted: automated review found critical or high-priority findings.