fix(scan): make saved results match the final draft

[ianw-oai]

Summary

The scanner could finish with no pending work, but the saved result could still contain pending items from earlier drafts and be marked partial. Earlier findings could also be added back after the scanner left them out.

Make the saved result match the final draft.

Changes

• Each save supplies the full current draft, including worker saves. Remove the code that combines it with older findings, evidence, and pending work.
• Keep earlier drafts for recovery if a scan is interrupted.
• Standard scans show the current phase without counting reviewed files.
• Do not mark a finding as fixed just because a later scan leaves it out.

Testing

• Before/after tests confirm that old pending items stay out of final results and CLI phase updates work without file counts.
• Plugin progress tests passed for source and packaged builds. All 26 scan completion tests passed.
• SDK: 2,999 passed, 57 skipped, one failure also present on unchanged main.
• Build, type, format, and plugin source checks passed.

Risk and rollout

If the scanner accidentally leaves a finding or supporting evidence out of its latest draft, the code no longer restores it automatically.

Existing saved reports, command-line options, and result formats stay unchanged. Standard SDK progress updates use zero for filesCompleted and filesTotal; callers should show the phase without a file counter.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-14T04:14:30.214911Z	2e0b866	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.