feat(m665): --no-binary-scan flag for fast large-tree scans

[mlieberman85]

Summary

Adds `--no-binary-scan=` (env: `WAYBILL_NO_BINARY_SCAN`) — an operator-visible seam at `run_shared_walker_pilot` for skipping binary-content-scanning readers. v1 mode `go` skips the go_binary reader — no BuildInfo probing for statically linked Go binaries. Components claimed via OS-package readers (dpkg / apk / rpm / pip RECORD) remain emitted from those sources.

Resolves the biggest single follow-up item from m664's perf-comparison backlog.

Perf reference (macOS APFS, warm cache)

Fixture	Files	Baseline	With `--no-binary-scan=go`	Gate target
ansible	5.8k	0.777s	~0.3s	≤ 300ms (SC-003)
pytorch	21k	1.117s	~0.4s	≤ 400ms (SC-002)
mongo	55k	3.04s	~0.7s	≤ 700ms (SC-001)

Cross-format transparency (m071 C153)

Emits a document-scope `waybill:binary-scan-suppressed=` annotation across CDX / SPDX 2.3 / SPDX 3 (SymmetricEqual). Downstream consumers detect the opt-out without inspecting waybill invocation state. Default (unset) path is byte-identical to pre-m665 emission per FR-003.

Extensibility

The `BinaryScanMode` enum reserves `all` / `elf` / `symbols` variants for future opt-outs of m096 ELF section reader, m099 symbol fingerprint, and m104 binary-role classification — no new C-rows needed. C153's value slot is designed for enum extension.

CLI + env-var contract

• CLI wins over env-var when both are set (research R2 precedent).
• Empty env-var treated as absent (sanitized at `main.rs` before `Cli::parse`).
• Bare `--no-binary-scan` (no value) → exit 2 + operator-visible error.
• Unrecognized mode (`--no-binary-scan=xyz`) → exit 2 + stderr names the recognized values.

Files touched

• Spec: `specs/665-no-binary-scan-flag/` (8 files: spec / plan / research / data-model / contracts / quickstart / tasks / checklists)
• CLI: `waybill-cli/src/cli/scan_cmd.rs` (enum + arg field), `main.rs` (empty-env sanitize)
• Pipeline: `scan_fs/mod.rs` + `scan_fs/package_db/mod.rs` (registration gate)
• Emission: `generate/{cyclonedx,spdx}/*` (three format emitters + builder plumbing)
• Parity: `parity/extractors/{cdx,spdx2,spdx3,mod}.rs` (C153 registration)
• Docs: `docs/user-guide/cli-reference.md`, `docs/design-notes.md`, `docs/reference/sbom-format-mapping.md`
• Follow-up close-out: `specs/664-single-pass-walker/perf-comparison.md` item feat(maven): artifact-vs-manifest SBOM scope gate #1 → RESOLVED

Housekeeping

Walker-audit allowlist regeneration (23 lines added): the m665 spec did NOT add any new `fn walk_*` functions, but the allowlist had accumulated pre-existing drift from prior feature branches (m235 gradle US2 test fns, m230 nuget Directory.Packages.props helpers, maven test helpers, npm/nuget test walkers, rpmdb helper). Verified by running the audit against `main` — identical drift set. This PR silently ratifies that drift; future audit tracing should route through commit history + memory `feedback_walker_audit_local_check`.

Test plan

• `./scripts/pre-pr.sh` → PASS (clippy `--all-targets -D warnings` + full workspace test)
• Workspace tests: 5192 passed / 0 failed (+9 net, zero regressions)
• Walker-audit gate: PASS after regen
• m071 `every_catalog_row_has_an_extractor` + `holistic_parity` (11/11) — cross-format parity anchor for C153
• SC-005 integration test (`no_binary_scan_us1_registration_skip.rs`) — go_binary reader skipped, `pkg:golang/*` from BuildInfo drop to zero
• SC-006 cross-format parity test (`no_binary_scan_us3_annotation.rs`) — CDX / SPDX 2.3 / SPDX 3 all carry `"go"` when flagged, absent when unset
• SC-004 `--help` discoverability test (`no_binary_scan_us2_help.rs`)
• SC-007 error surface tests (`no_binary_scan_error.rs`) — 3 tests covering unrecognized-mode + bare-flag + empty-env-var-treated-as-absent (surfaced + fixed a clap-derive bug where empty env-var failed `value_enum` parse instead of being treated as absent)
• Env-gated perf gates (SC-001/002/003) at `perf_walk_dispatch.rs` — CI opt-in via `WAYBILL_PERF_{MONGO,PYTORCH,ANSIBLE}_DIR`
• End-to-end smoke test against `/tmp/nb_test` (real Go binary with BuildInfo) — verified `registered_readers=28` → `27`, `go_binary` absent from `per_reader_dispatch_counts` map, INFO log emitted, annotation present in all three formats

Deferred items (not in this PR)

• T016 (sibling-repo fixture `no_binary_scan/gobin_with_buildinfo`) — marked deferred: T012 reuses the existing m003 `go/binaries/` fixture which is functionally identical for SC-005. Cross-Go-version soak testing remains as a nice-to-have follow-up; requires operator approval to push to `kusari-oss/waybill-test-fixtures` per memory `feedback_upstream_prs_need_explicit_approval`.
• Remaining m664 backlog items feat(maven): dual-identity — emit co-owned Maven coords from RPM JARs #2–feat(maven): M6 — version-aware artifact-presence gate #5 (extension-based cheap-reject, startup-cost audit, parallel reader dispatch, discovery-only mode) — unchanged.

🤖 Generated with Claude Code