[10/48] CONFIG: Add wizcli_vulns delta-scan sparse-checkout branch for parity

[anota-fernandocosta]

Severity: High (parity defect — closes a gap visible only on wizcli_vulns)

Evidence

• wizcli_secrets (api/config.yaml:573), wizcli_iac (api/config.yaml:647), and wizcli_sast (api/config.yaml:721) all branch on HUSKYCI_DELTA_SCAN=true + non-empty %CHANGED_FILES% and run git clone --no-checkout + git sparse-checkout add + git checkout -- per file.
• wizcli_vulns at api/config.yaml:805 has no delta-scan branch and always performs a full clone, even when HUSKYCI_DELTA_SCAN=true and the client passed changedFiles.

Impact

A PR that changes only a handful of files still pays the full-clone + full-tree Wiz vulnerability scan cost on wizcli_vulns, even though every other WizCLI variant respects the delta path. This is the smallest, lowest-risk delta-related win available.

Recommendation

Port the existing sparse-checkout block from wizcli_iac / wizcli_sast into wizcli_vulns. Preserve the ERROR_SPARSE_CHECKOUT sentinel that analyze() in api/securitytest/securitytest.go matches on. Keep the ERROR_CLONING and ERROR_AUTH_WIZCLI / ERROR_RUNNING_WIZCLI_SCAN sentinels untouched.

Dependencies

• None.
• Note: see [34/48] Sparse-checkout shell logic duplicated across every scanner cmd block in config.yaml #44 — all scanner sparse-checkout shell blocks are duplicated and must stay in lockstep.

Cross-references

• Assessment: docs/assessments/wizcli-performance-assessment-01.md — Confirmed finding Feat/wizcli huskyci integration #4 (parity component).
• Existing: [34/48] Sparse-checkout shell logic duplicated across every scanner cmd block in config.yaml #44 (sparse-checkout duplication).

Verifiable by: Static analysis; bash -n on the rewritten block; functional test with HUSKYCI_DELTA_SCAN=true and a 1-file changedFiles.