Description

The image enricher returns ScanSucceeded when reusing an existing scan from the database, making ImageUpdated always true even when no image data changed. This prevents downstream consumers from distinguishing genuinely updated images from unchanged ones, and results in a significant volume of unnecessary UpdateImage messages to secured clusters, and subsequent storage.Image proto deserialization in Sensor.

This PR introduces a ScanReused enum value in ScanResult, returned when the enricher reuses an existing DB scan unchanged. ImageUpdated now correctly evaluates to false for these images, enabling the rest of the targeted admission controller cache invalidation stack to optimize message flow in the short-circuit reprocessor path. Given the image proto can be large, with scan data for large number of CVEs, metadata and image signatures, and multiple secured clusters, this constitutes significant savings.

A HasScanData() helper has been added to ScanResult to avoid regressions in API paths (roxctl image scan, SBOM export, WatchImage) that validate scan presence - these paths now accept both ScanSucceeded and ScanReused as valid.

Note:
Future PRs will use imageUpdated to decide between UpdatedImage messages (for each changed image) vs. a batched RefreshImageCacheTTL message (for unchanged images) in the short-circuit reprocessor path. Without this fix, the absence of accurate ImageUpdated flag, makes future optimizations impossible.

User-facing documentation

• CHANGELOG.md is updated OR update is not needed
• documentation PR is created and is linked above OR is not needed

Testing and quality

• the change is production ready: the change is GA, or otherwise the functionality is gated by a feature flag
• CI results are inspected

Automated testing

• added unit tests
• added e2e tests
• added regression tests
• added compatibility tests
• modified existing tests

How I validated my change

• Unit tests verify ScanReused is returned when useExistingScan is true, and ImageUpdated is false in that case
• TestHasScanData covers all ScanResult enum values
• SBOM export tests cover ScanReused returning HTTP 200 (regression check)
• Traced all ScanResult consumers to confirm no regressions: periodic reprocessor uses ForceRefetchCachedValuesOnly (never hits ScanReused); WatchImage uses IgnoreExistingImages (never hits ScanReused); ScanImage and SBOM export use UseCachesIfPossible (can hit ScanReused, covered by HasScanData())