fix(sdk): allow parallel ChatGPT scans

[soyeon-oai]

Summary

ChatGPT scans currently keep the managed credential-home lock for the full scan, so a second scan can wait without starting workers or reporting usage. Narrow the lock to shared startup work and keep mutable scan configuration isolated so compatible scans can execute concurrently.

Refs #228. This is complementary to #229, which handles malformed stale-lock owner PIDs.

Changes

• release the managed credential-home lock after runtime setup and credential import, before workbench registration and Codex execution
• keep only credential, plugin, permission, and selected provider state in the shared credential home
• preserve supported Codex overrides in the hardened per-scan SDK configuration without persisting them into the shared credential home
• store Deep Scan settings in each runtime workspace when the plugin advertises isolated-config support
• retain the shared configuration and full scan lock for legacy or custom plugins that do not support the isolated Deep Scan configuration path
• cover concurrent ChatGPT Deep Scans, distinct model and worker settings, general Codex overrides, legacy plugin compatibility, and the Windows CI shard mapping

Testing

• pnpm run types
• pnpm dlx bun@1.3.13 test --reporter=dot (1132 passed, 11 skipped)
• pnpm dlx --package=bun@1.3.13 node scripts/run-windows-ci-tests.mjs 1 (5 passed)
• pnpm run build
• pnpm run format
• packed the npm tarball and ran node scripts/check-package.mjs <tarball>

Risk and rollout

The managed credential identity and plugin installation remain shared, and startup mutations remain serialized. Compatible plugins receive isolated Deep Scan settings and can run concurrently. Legacy or custom plugins without the isolated-config protocol continue to use the shared configuration under the full credential-home lock, preserving their existing settings behavior. Existing stale-lock recovery behavior is unchanged, so #229 remains independently useful for malformed owner metadata.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d35ff64529

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e05019fe3f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".