fix(scan): preserve registered IDs and fail-fast preflight

[mldangelo-oai]

Fixes #290
Fixes #292

Contributor-preserving follow-up to #296. Thanks to @dipeshbabu for the original pull request and to @charle-z for the earlier public patch; this branch retains the original commits and credits both contributors.

Summary

• Merge current main into the original contributor history.
• Put the workbench-registered scan ID directly into standard-scan artifact instructions and valid deep-scan MCP JSON.
• Keep required scan-skill validation ahead of registration so a missing skill does not create a failed scan record.
• Cover standard and deep scans with and without reviewer feedback, including negative assertions and parsed deep-scan arguments.
• Preserve newer upstream finding-history coverage when resolving the merge conflict.

A maintainer-owned follow-up is necessary because direct maintainer pushes to personal forks are unavailable.

Verification

• Full SDK suite: 1,036 passed, 11 platform-specific skips, 0 failures across 51 files.
• Focused registered-ID and missing-skill regressions: 5 passed.
• pnpm run types
• pnpm run format
• pnpm run build
• Packed and inspected the npm tarball: 203 verified entries.
• Verified the public SDK export, codex-security --version, and codex-security --help.
• git diff --check origin/main...HEAD

[mldangelo-oai]

@codex review the exact current head c7e40ae. Focus on early plugin-skill validation, registered scan IDs in standard and deep prompts, valid structured MCP JSON, and preserving current-main finding-history behavior.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Chef's kiss.

Reviewed commit: c7e40ae710

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: c7e40ae710

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.