feat(cli): enable cancellable scans over MCP - #682

Summary

MCP clients can currently inspect CLI metadata but cannot run security scans. This change exposes a scan tool through codex-security --mcp, so another agent can run scans and receive structured results without invoking a shell command for each scan.

Changes

• Merge main at 3f3aa8e9 into the scan branch, preserving its mock scans, workflow reuse, authentication, budget controls, and canonical plugin packaging.
• Reuse the existing CLI scan schemas, option mapping, and execution path for standard, Deep, path, and Git diff scans, including dry runs.
• Use the MCP SDK directly to forward request cancellation, cancel active scans on disconnect or server shutdown, and wait for runtime cleanup. Keep diagnostics on stderr and protocol messages on stdout.
• Handle cancellation for zero and empty-string request IDs, including cancellation before tool validation completes, and retain stdout error handling until the output stream closes.
• Return each scan's { exitCode, data?, error? } outcome, preserving findings when coverage is incomplete or a severity policy fails. Keep concurrent requests independent.
• Keep patching, PR creation, and other commands outside the MCP scan tool. Update metadata, MCP registration diagnostics, documentation, and installed-package smoke coverage.

Testing

• 211 focused CLI, MCP, mock-scan, and authentication tests passed with zero failures. MCP regressions cover the merged mock/workflow options and noninteractive budget behavior.
• Generated-model consistency, MCP and SDK TypeScript checks, package formatting, and git diff --check: passed.
• Portable plugin Ruff checks and source compatibility checks: passed.
• Production build and complete packed/installed npm package validation: passed, including MCP scan preflight, native Node lifecycle and terminal contracts, dashboard assets, and 122 bundled plugin files (398 archive entries).
• Three independent native reviews and independent verification of the exact merge commit: passed.

Tests use synthetic fixtures; no billable scans or external publication were performed.

Risk and rollout

This adds the scan tool to the existing stdio --mcp interface; existing CLI flags and defaults remain unchanged. MCP scan arguments use camelCase option names and exclude patch, patchSeverity, and createPr. info.scanMcp now reports true.

The server runs locally with its configured credentials and filesystem access. Scans may incur model costs, write artifacts, and run repository tools. Clients must allow enough time for scans and use cancellation to stop unwanted work. No network listener or separate service is introduced. The direct MCP SDK dependency uses the version already present through Incur.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.