Diff scan inventory omits PowerShell .ps1 files

[aaronwhippo]

Environment

• Codex Security plugin: 0.1.22
• Host: Codex desktop on macOS
• Scan mode: prompt-driven diff scan

The current default-branch plugin source also omits .ps1 from TEXT_CODE_EXTENSIONS.

Reproduction

1. Scan a Git diff containing a JSON file, a Python test, and changed PowerShell .ps1 files.
2. Prepare and list the Codex Security review inventory.
3. Try to record a discovery candidate whose location is one of the changed .ps1 files.

Expected behavior

Changed production PowerShell files are included in the authorized review inventory, so they can be reviewed and referenced by candidates.

Actual behavior

The prepared inventory contains the JSON file but omits the changed .ps1 files. Recording the candidate fails with:

discovery candidates: candidate input row 1: locations: expected at least one in-scope file

Manual review can cover the PowerShell change, but the scan cannot attest full native inventory coverage.

Likely cause

plugins/codex-security/scripts/generate_in_scope_files.py filters paths through TEXT_CODE_EXTENSIONS, and plugins/codex-security/scripts/rank_preview.py does not include .ps1.

Suggested fix

Add .ps1 to the supported text-code extensions, consider the related .psm1 and .psd1 extensions, and add a regression test proving diff inventories retain changed PowerShell files.