Add provenance scanner for diagnostics links - #293

backend/app/scripts/ingestion/diagnostics_link_scanner.py:378

• The valid archive layouts are <tier>/<case> and <tier>/<case_group>/<case>, but this rejects the ungrouped two-part form and accepts an unsupported four-part form. As a result, normal ungrouped zppy publications are never discovered, while over-nested directories can be linked. The group calculation must use the middle component only for the three-part layout.

    if len(parts) not in {3, 4} or parts[0] not in {"production", "development"}:

backend/app/scripts/ingestion/diagnostics_link_scanner.py:398

• A filename can match the regex but contain an invalid timestamp (for example, month 13). strptime() then raises ValueError outside the per-candidate exception handler and aborts the entire scan, contrary to the requirement to skip malformed provenance. Treat an invalid parsed timestamp as a non-candidate.

    return datetime.strptime(match.group(1), "%Y%m%d_%H%M%S_%f").replace(
        tzinfo=timezone.utc
    )

backend/app/scripts/ingestion/diagnostics_link_scanner.py:264

• This boundary check uses the raw URL path, so dot segments bypass it: /archive/../outside starts with /archive/ but resolves to /outside. Percent-encoded dot or slash variants can have the same effect depending on the server. Normalize and validate the decoded path before accepting the diagnostics URL so links cannot escape the configured archive.

                if (url.scheme, url.netloc) != (
                    base.scheme,
                    base.netloc,
                ) or not url.path.startswith(base.path.rstrip("/") + "/"):

docs/user/diagnostics.md:26

• This says the scanner runs every 15 minutes, but the included scheduler example runs it hourly (nersc.crontab.example:29). Users will wait for a cadence the deployment does not provide. Avoid hardcoding the cadence here or align it with the deployed schedule.

4. Wait for the scheduled SimBoard scanner to attempt linkage. Linking is not immediate; the scanner runs periodically every 15 minutes.