feat(sdk): publish security findings through the connected Linear app

[kmbroai]

Summary

Publish prepared security findings through an existing authenticated Codex session and its connected Linear application, without introducing a separate Linear credential flow.

Changes

• Expose the programmatic publishScan(scanDirectory, options) API and typed onProgress publication events.
• Accept an optional AbortSignal, terminate and await the entire Codex process tree on Unix and Windows, and preserve verified partial receipts before reporting cancellation.
• Invoke the existing Codex runtime with the ambient user configuration and stream exact prepared issue data through stdin.
• Stream Codex activity and independently verified Linear issue-creation results as they arrive, including fragmented JSONL output.
• Verify completed connected-app issue-creation events against the selected team, optional project, title, description, and priority.
• Support team-only publication without project lookup or project mutation arguments while retaining exact project/team validation when a project is supplied.
• Recognize actual dotted linear.save_issue connected-app events, one explicitly verified legacy alias, and Linear responses that expose issue identifiers as id.
• Support dry runs, empty scans, partial failures, more than 25 findings, repeated publications without deduplication, and failing optional progress observers.
• Write publication receipts outside sealed scan artifacts using hashed scan-ID filenames.
• If optional receipt storage fails after independently verified issue creation, return accurate created and failed results with a sanitized structured warning instead of encouraging duplicate publication.
• Add the new compiled modules to the public package allowlist.

Testing

• Focused connected-app event verification and publishing SDK tests: 46 passed with 142 assertions.
• tsc --noEmit: passed.
• Generated-model validation, formatting, and an independent SDK build: passed.
• One real synthetic child process verifies fragmented, malformed, CRLF, and unterminated Codex JSONL, two dotted-tool successes, one failure, ordered progress, and the persisted receipt.
• Real subprocess regressions verify interrupted parents, signal-resistant grandchildren, forced termination, partial receipts, and Windows process-tree cleanup under Node 22 and Node 24.
• Receipt-failure regressions cover complete and partial verified publication, credential redaction, fabricated issue claims, zero created issues, and cancellation.
• Preserved the complete eight-case destination, payload, priority, and update-prevention security matrix without duplicating it for the legacy alias.

Risk and rollout

• Uses the existing authenticated connected application and preserves its configured approval policies.
• Does not add API tokens, fallback destinations, issue readback, duplicate matching, or hardcoded application identifiers.
• Progress observers cannot interrupt publication, and issue progress is emitted only for verified destination-specific mutation results.
• Stacked on the sealed-scan publication foundation.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[soyeon-oai]

Reviewed the exact PR delta. I found four publication correctness and safety issues.

The base branch was changed.