fix: honor stat-aware cache lookup contract

[fallintoplace]

Summary

• pass caller-provided stat snapshots through the stat-aware cache lookup wrappers instead of dropping them on the floor
• reuse the provided stat only for the first identity-capture probe so the stronger identity-bound validation path stays intact
• add regression coverage that proves both wrappers forward the stat object they accept

Root cause

The identity-hardening cache refactor moved both get_cached_result_with_stat() helpers onto the identity-bound lookup path, but stopped forwarding the caller-provided stat_result. The API still advertised stat reuse even though the argument was ignored.

Impact

Callers that already computed os.stat_result can use the stat-aware lookup helpers without paying for a dead parameter, and the lookup still goes through the hardened identity validation flow.

Validation

• uv run ruff format modelaudit/cache/cache_manager.py modelaudit/cache/scan_results_cache.py tests/cache/test_cache_correctness.py
• uv run ruff check --fix modelaudit/cache/cache_manager.py modelaudit/cache/scan_results_cache.py tests/cache/test_cache_correctness.py
• uv run mypy modelaudit/cache/cache_manager.py modelaudit/cache/scan_results_cache.py tests/cache/test_cache_correctness.py
• PROMPTFOO_DISABLE_TELEMETRY=1 uv run pytest tests/cache/test_cache_correctness.py
• PROMPTFOO_DISABLE_TELEMETRY=1 uv run pytest tests/cache/test_cache_correctness.py -k 'cache_manager_reuses_lookup_identity_for_miss or scan_results_cache_get_cached_result_with_stat_reuses_provided_stat or cache_manager_get_cached_result_with_stat_reuses_provided_stat'

Notes

• Full-repo uv run mypy modelaudit/ packages/modelaudit-picklescan/src packages/modelaudit-picklescan/tests tests/ still reports existing os.listxattr / os.setxattr / os.getxattr typing errors in modelaudit/cli.py and tests/test_cli.py.
• In this environment, the broader PROMPTFOO_DISABLE_TELEMETRY=1 uv run pytest -m 'not slow and not integration' --maxfail=1 -x lane also fails on upstream/main in tests/cache/test_cache_correctness.py::test_scan_cache_revalidates_sources_after_nested_importer_cache_population[changed-namespace].