feat(cli): publish completed security scans to Linear

[kmbroai]

Summary

Add codex-security publish scan [SCAN_DIR] so completed security scans can be published to an explicitly selected connected Linear team and project.

Changes

• Add the nested publication command with --to linear, --linear-team, --project, --dry-run, and structured JSON output.
• Select an existing completed scan interactively when no scan directory is provided; exclude missing, replaced, inaccessible, and symlinked scan directories before showing the picker.
• Resolve destination defaults from CODEX_SECURITY_LINEAR_TEAM and CODEX_SECURITY_LINEAR_PROJECT while letting explicit flags take precedence.
• Preserve database-backed created-issue results, partial failures, accurate exit codes, and scan-ID provenance.
• Display sanitized optional-receipt warnings on stderr without hiding created issues, contaminating JSON stdout, or changing publication exit codes.
• Handle SIGINT and SIGTERM without exiting early: await child shutdown and durable recovery, preserve recovery guidance, and return conventional exit codes 130 and 143.
• Document source-code evidence, destination requirements, 20-item concurrent batches, and existing local scan-history requirements.
• Add an installed-package CLI publication dry-run smoke.
• Preserve sealed-file identity on Windows Node 22 using the independently verified fail-closed, two-handle identity check from fix(sdk): preserve sealed-file identity on Windows Node 22 #454.
• Exercise actual sealed scans, bundled Python, SQLite associations, durable handoff, CLI JSON, receipts, and partial failures end to end.
• Keep dashboard styling, relative scan ages, aligned columns, terminal rendering, and live interactive presentation in the follow-up UX PR.

Testing

• Focused CLI routing, real-filesystem picker filtering, receipt warnings, interruption handling, Windows sealed-file validation, and real SQLite-backed integration: 90 passed with 563 assertions.
• The CLI command layer retains 15 focused routing, destination, dry-run, real-directory selection, receipt-warning, interruption, and exit-code tests; cross-batch behavior is verified by real SQLite integrations.
• Real end-to-end sealed scans verified 23 successful findings across 20 + 3 concurrent batches and 21 persisted successes with one failure across 20 + 2 batches.
• A real sealed-scan interruption persists one durable mapping and one independently verified mutation in SQLite, writes the partial receipt, retains its recovery handoff, and exits 130 with clean JSON stdout.
• A real sealed-scan receipt-failure integration preserves both SQLite-backed issue records, redacts sensitive diagnostics, avoids duplicate mutation attempts, and exits successfully.
• Windows sealed-file identity, complete contract validation, CLI publication, and all four actual SQLite integrations remain covered.

Risk and rollout

• Publication requires an existing authenticated Codex profile, connected Linear application, and completed scan in local scan history.
• Every finding creates a new issue; descriptions include source-code snippets and vulnerability details.
• Stacked on the durable database-backed publisher; enhanced interactive presentation follows separately.
• Includes the exact production implementation and security regression already validated across the full Windows matrix in fix(sdk): preserve sealed-file identity on Windows Node 22 #454; existing installed-package publication smoke verifies the real Node 22 path.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[soyeon-oai]

Reviewed the exact PR delta. I found one interactive-selection reliability issue.

[soyeon-oai]

[P2] Exclude unavailable scan directories before presenting the picker. list-scans can retain completed history after its artifact directory was deleted or replaced, but this filter checks only database fields. The user can select a row that is guaranteed to fail later with Scan directory must be an existing non-symlink directory. Validate each candidate up front (or annotate and skip it with a reason) so every offered choice is publishable.

[kmbroai]

good call.