Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@sensor/admission-control/manager/manager_impl.go`:
- Around line 533-541: The loop in the invalidation path currently chooses a
single cache key variant based on m.currentState() flatten mode (using cacheKey
= key.GetImageId() or key.GetImageIdV2()), which can leave the other variant
stale; instead, in the loop over inv.GetImageKeys() always attempt eviction for
both non-empty forms: call the evict/remove logic for key.GetImageId() if
non-empty and separately for key.GetImageIdV2() if non-empty (do not gate on
flatten), and increment invalidated appropriately for each successful eviction;
update the code around the cacheKey/flatten logic in the loop that references
m.currentState(), key.GetImageId(), key.GetImageIdV2(), and the eviction call so
both variants are evicted unconditionally when present.

In `@sensor/common/admissioncontroller/management_service.go`:
- Line 114: Create the invalidation iterator before calling sync so it won't
miss events: move the call to s.imageCacheInvalidationStream.Iterator(true) (the
imageCacheInvIt variable) to immediately before the sync(stream) invocation (or
at the start of the method where the stream is set up) so the iterator exists
prior to s.sync(stream) and will observe any invalidation events emitted during
sync.

In `@sensor/common/reprocessor/handler.go`:
- Around line 65-69: The sender (central) must check sensor capabilities before
broadcasting InvalidateImageCache messages: update the broadcast sites in
service_impl.go (the InvalidateImageCache calls around lines 1277 and 1293) to
gate sending with
AllSensorsHaveCapability(centralsensor.TargetedImageCacheInvalidationCap) or
implement a fallback broadcast path for sensors lacking the capability; ensure
the capability symbol centralsensor.TargetedImageCacheInvalidationCap and the
capability-advertising handler (the function returning
[]centralsensor.SensorCapability in sensor/common/reprocessor/handler.go) are
used to decide routing so old sensors don’t receive unsupported targeted
invalidation messages.

---

Nitpick comments:
In `@sensor/common/reprocessor/handler_test.go`:
- Line 37: The test currently uses gomock.Any() for
mockAdmCtrlSettingsMgr.EXPECT().InvalidateImageCache which only asserts
invocation; change the expectation to assert the actual payload content by
matching the expected key set for each test case (use gomock.Eq(expectedKeys) or
gomock.Match(func(v interface{}) bool { /* compare against expectedKeys */ }) as
appropriate) and update both occurrences (the call at
mockAdmCtrlSettingsMgr.EXPECT().InvalidateImageCache and the other occurrence
around lines referenced) so the mock validates the exact IDs/full names
forwarded to InvalidateImageCache rather than accepting any value.