feat(classify): retain severity progress and recovery details

[kmbroai]

Summary

Severity classification already saves individual assessments, but interruption leaves little durable progress or recovery context. Retain run progress and failure details, and show completed assessment reuse during retry.

Changes

• Persist run status, phase, current finding, completed and reused counts, and failure details alongside assessment checkpoints.
• Show CLI progress and scan history with a retry command pinned to the original scan, selection, and policy inputs.
• Separate assessment work from final artifact writing so export retries reuse completed reviews. Commit each assessment before optional progress in the same workbench call, preserving it if progress storage or commit fails. Coalesce cached progress updates.
• Keep optional progress output failures from stopping classification, and preserve retry quoting on Unix and Windows. Follow registered scans across archival using physical directory identity while retaining explicitly selected copies.

Testing

• Passed on the final combined stack: 360 Python tests for SQLite persistence, scan recovery, retained findings, workflow state, and helper commands.
• Passed on the final combined stack: 39 workflow integration tests covering checkpoint reuse, cancellation, publication, process ownership, database aliases, and saved-artifact preservation.
• Passed: generated-model checks, SDK/MCP types, formatting, builds, installed-package verification, Ruff, and portable source checks with their tests.
• Three native reviews and independent verification passed for this PR's exact base and head.
• Full SDK suites run on Linux, macOS, and Windows in the linked CI checks.

Risk and rollout

Depends on #858 (dedupe resilience). Adds an append-only SQLite migration and additive SDK progress and error fields. Existing command arguments and assessment reuse rules remain in place. Explicit reprocessing still repeats the requested reviews; saved artifacts and policy bindings continue to govern reuse.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-10T03:32:58.743809Z	e2bdac3	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.