Approved scanner-only rollout. Preserve Java scanning and add workflow scanning using the immutable shared worker.