feat(sdk): publish findings through durable concurrent batches

[kmbroai]

Summary

Publish prepared security findings in bounded concurrent batches and derive final results from validated durable records stored in local scan history.

Changes

• Group connected Linear issue creation into batches of at most 20 findings.
• Write finding-to-issue mappings into a private durable handoff instead of trusting model-generated summaries.
• Validate exact finding, occurrence, destination, team, optional project, title, description, and priority before importing publication records.
• Preserve team-only publication through private handoffs, recovered issue mappings, SQLite records, receipts, and results without inventing a project identifier.
• Read final issue identities, URLs, and receipts back from the transactional workbench store.
• Keep database-backed issue creation successful if its optional receipt fails, returning a sanitized warning without rerunning remote mutations.
• Preserve partial successes, recover incomplete handoffs, and retain recoverable mappings if database persistence fails.
• After cancellation, await Codex process-tree termination, persist verified completed issues, write an accurate partial receipt, and retain the private handoff with duplicate-avoidance recovery instructions.
• Keep CLI commands, interactive presentation, and end-to-end CLI integration out of this SDK layer.

Testing

• Real SQLite publication-store, connected-app event validation, and durable publisher tests: 70 passed with 286 assertions.
• Verified a 41-finding 20 + 20 + 1 batching boundary, malformed or absent Codex output, out-of-order completion, exact destination validation, partial failures, and durable recovery.
• Consolidated recovery assertions into the stronger case preserving both written and independently salvaged issue mappings when database persistence fails.
• Verified pre-aborted requests, cancellation during preparation, interrupted partial imports, database failures, receipt failures, retained private handoffs, and real signal-resistant child processes.

Risk and rollout

• Publication still uses the existing authenticated Codex profile and connected Linear app.
• No issues are created before validating the completed local scan and every finding association.
• Stacked on the workbench publication-persistence layer.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[soyeon-oai]

Reviewed the exact PR delta and exercised the stacked CLI against a real synthetic Linear publication. I found three durability/verification issues.

[soyeon-oai]

Additional issues reproduced during E2E review on the latest stack (#453 86384db; integrated CLI #455 1fd8b0d; identical publisher source).

The base branch was changed.