Run metadata preclass scans before final verdict (#1721)

Metadata preclass bytecodes ran after cli_magic_scan() finalized
the layer verdict. Evidence added by those hooks, or by the
legacy metadata JSON scan, could miss the root-layer verdict
update and clean-cache decision.

Move root metadata preclass work into cli_magic_scan() for the
root layer, before verdict finalization. Keep final metadata
serialization in scan_common(), preserve legacy RootFileType
handling, log long JSON strings in chunks, and normalize CL_BREAK
from the preclass hook to a successful control result.

Run post-scan callbacks only after the metadata preclass work has
updated the layer verdict. Reconcile the verdict and status again
after callbacks, because either callback API can add evidence or
trust the current layer.

Derive non-trusted layer verdicts from current evidence so removed
indicators do not leave stale non-clean verdicts behind.

Gate clean-cache insertion on a successful status so terminal scan
errors are not cached as clean.

CLAM-2991

Author: val-ms