fix(sdk): preserve canceled scan state

[Hughhhhcoder]

Summary

Fixes #44. When a caller cancels a registered SDK scan, the scan history is
currently finalized with fail-scan, so an intentional cancellation is stored
as a failure instead of a cancellation.

Changes

• Route caller- or client-close-induced ScanInterruptedError values through
  cancel-scan.
• Keep fail-scan for ordinary failures, internal tracking failures, and
  ScanCostLimitExceededError so those errors retain their message and cost
  metadata.
• Add an orchestration regression that verifies the workbench command and
  arguments for a canceled scan.

Testing

• bun test --timeout 30000 tests-ts/api.test.ts — 139 passed, 2 skipped, 0 failed.
• bun test --timeout 30000 tests-ts/scan-recovery.test.ts — 40 passed, 0 failed.
• pnpm --ignore-workspace run lint — passed.
• pnpm --ignore-workspace --dir ../../plugins/codex-security/mcp-app run typecheck — passed.
• pnpm --ignore-workspace run generate:models:check — passed.
• pnpm --ignore-workspace run format — passed.
• git diff --check — passed.

Risk and rollout

This changes only the persisted lifecycle command for explicit caller/client
cancellation. Ordinary failures and cost-limit recovery retain the existing
failure path and metadata. No public API or scan input contract changes.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-08-29T05:02:04.711793Z	53a8c9f	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.