feat(plugin): add hosted cyber access advisory

[kmbroai]

Summary

Add a non-blocking hosted cybersecurity access status advisory before Codex Security scans.

Changes

• Register the hosted Codex Security Access app in the bundled plugin while preserving its existing app integrations.
• Check access once after Standard/diff scan preflight and once in the parent before a Deep Scan.
• Show access and enrollment guidance without blocking scans when the hosted app is unavailable.
• Add a structured regression test for hosted app registration and local MCP server separation.

Testing

• bun test --timeout 30000 tests-ts/plugin-apps.test.ts tests-ts/api-preflight-config.test.ts tests-ts/deep-scan-reducer-recovery.test.ts tests-ts/deep-scan-worker-shutdown.test.ts tests-ts/plugin-report-limits.test.ts: 23 passed, 216 assertions.
• tsc -p tsconfig.build.json: passed.
• node scripts/generate-models.cjs --check: passed.
• prettier --check --ignore-path .gitignore --ignore-path .prettierignore '**/*.{cjs,mjs,js,ts,json,md}': passed.
• npm pack --ignore-scripts followed by node scripts/check-package.mjs <package.tgz> plugin-files.json: validated all 202 packaged entries.

Risk and rollout

• Keep this pull request in draft and do not merge it until Codex Security plugin v0.1.20 has been released.
• Installations without the hosted access integration warn and continue scanning; access status is advisory and never grants, gates, or blocks a scan.
• Deep Scan workers never invoke the hosted access integration.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.