Handle parses the requested images and delegates the guarded scan to the
Scanner. A targeted image update waits for the guard; a full scan is
skipped when one is already running.
Scanner runs guarded container update scans. wait blocks for the
single-flight guard; when false the run is skipped if one is already
in progress. The guard itself lives in the Scanner, not this handler.