Entry point called by the scanner engine. Sealed final so cross-cutting concerns (logging, timing, exception guarding) can be added here without touching every concrete rule.