code-modernization: modernize-harden only scans legacy code, but is recommended as the step after verifying the built code

Plugin: code-modernization 1.0.0, /code-modernization:modernize-harden and /code-modernization:modernize-status next-step order

modernize-status and modernize-verify name /code-modernization:modernize-harden <system> as the step after a PROVEN, signed verification. But harden (and workflows/harden-scan.js, const legacyDir = \legacy/${system}`) only scans the legacy code. After a reimagine or rewrite, the code that will go to production has never been security-scanned, while the recommended "next step" re-scans unchanged legacy code and would overwrite the earlier SECURITY_FINDINGS.md`.

Repro: reimagine track, verify PROVEN + signed, run the recommended modernize-harden: the finders audit legacy/<system> only; the patch targets legacy paths.

Expected: after transform/reimagine, harden scans the built code (modernized/<system>*), or takes a --target argument, and writes to a separate findings file; the patch and the "apply with patch -p1 -d legacy/..." instructions fit the target. (We worked around it by running the same 5-finder + refute + confirm workflow on the new code; it found a High issue the legacy scan could not.)