feat(sdk): persist security finding publication associations

[kmbroai]

Summary

Persist security-finding publication associations in existing local scan history without adding issue-creation or CLI behavior.

Changes

• Add an append-only workbench migration for finding-to-external-issue associations.
• Validate the completed scan, original scan directory, finding IDs, occurrence IDs, and destination before accepting publication records.
• Add file-backed Python workbench preflight and transactional import commands with current-run database readback.
• Add the TypeScript publication-store adapter and package allowlist entry.
• Preserve existing scan history, support idempotent record replay, and keep independently created issues distinct.

Testing

• Real SQLite publication-store, existing CLI workbench, and saved-scan-history tests: 27 passed with 147 assertions.
• Validated missing databases, mismatched findings, cross-scan occurrences, invalid destinations, transaction rollback, and repeated publication.

Risk and rollout

• The migration is additive and retains existing scan and finding records.
• This layer does not contact Linear, start Codex, or expose publication commands.
• Stacked on the connected Linear publication engine.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[soyeon-oai]

Reviewed the exact PR delta. I found one sealed-scan integrity issue in the publication preflight.