Add structured vulnerability findings workflow

[ross0x01]

Summary

• add the persistent-only create_vulnerability_report tool with strict validation, deterministic same-chat dedupe, server-side CVSS 3.1 scoring, and Agent/Agent-long wiring
• add global Findings navigation, inline cards, reusable right-sidebar/mobile detail, search and filters, deletion confirmation, chat/account cleanup, and reactive source-message scrubbing
• sanitize shared reads and shared-chat forks to a non-clickable metadata-only card and add lifecycle, contract, UI, CVSS, validation, and security coverage

Validation

• corepack pnpm typecheck
• corepack pnpm lint (passes with 6 existing warnings)
• corepack pnpm exec eslint convex/findings.ts convex/messages.ts convex/sharedChats.ts convex/chats.ts convex/userDeletion.ts convex/schema.ts convex/__tests__/findings.test.ts convex/__tests__/findings.shared-security.test.ts convex/__tests__/chats.agentApprovalLifecycle.test.ts convex/__tests__/userDeletion.test.ts --ext .ts
• corepack pnpm test --runInBand (273 suites, 2749 tests)
• git ls-files -m -o --exclude-standard -z | xargs -0 corepack pnpm exec prettier --check
• Google Chrome desktop and 390x844 mobile verification of the inline card, Computer sidebar, /findings list/search/filter/detail, public safe card, delete confirmation, reactive removal, and reload behavior

Manual verification

1. In a persistent Agent chat, validate a reproducible vulnerability with concrete evidence and a working PoC; confirm one compact card appears without auto-opening.
2. Click the card and confirm the complete report opens in the Computer sidebar; repeat on mobile and confirm the full-screen detail.
3. Open /findings, search and filter the record, open its detail, and follow the source-chat link.
4. Share the chat publicly and confirm the card is non-clickable and contains only title, target, severity, and CVSS.
5. Delete the finding and confirm the workspace row and source-message card disappear after reload.

[ross0x01]

Replaced by #915 on a clean one-commit branch. Trigger.dev failed to clone this branch three times before build, while the identical tree deployed successfully as preview version 20260716.2 through the authenticated CLI.