scanner: undfscand v1.0.0 — UNDF patch verification scanner (C/pthreads)

Self-contained C scanner that reads UNDF-REGISTRY.json, parses patch .md
files to extract file paths and code patterns, walks a target directory
tree, and classifies each registered defect as PATCHED/UNPATCHED/UNKNOWN/
NOT_FOUND. Thread pool via pthreads. Bundled MD5+SHA256, no external deps.

Makefile

@@ -63,3 +63,30 @@ TOPDIR := $(strip $(patsubst %/, %, $(dir $(makefile_path))))
 
 # ... and then we can include the real makefile to bootstrap the build
 include $(TOPDIR)/make/PreInit.gmk
+
+# ============================================================
+# UNDF Scanner targets (independent of JDK build system)
+# ============================================================
+
+scanner/undfscand: scanner/undfscand.c
+	$(MAKE) -C scanner
+
+scan-local: scanner/undfscand
+	./scanner/undfscand \
+	  --registry UNDF-REGISTRY.json \
+	  --defects defects/ \
+	  --target $(HOME)/git \
+	  --threads 8 \
+	  --output scan-report.json
+	@echo "Report: scan-report.json"
+
+scan-unsandbox: scanner/undfscand
+	./scanner/undfscand \
+	  --registry UNDF-REGISTRY.json \
+	  --defects defects/ \
+	  --target /home/fox/git \
+	  --threads 8 \
+	  --format json \
+	  --output scan-report-$(shell date +%Y%m%d-%H%M%S).json
+
+.PHONY: scan-local scan-unsandbox