fix(multiscan): persist scan warnings in receipts

[sylvesterkaczmarek]

Summary

Preserve bulk-scan run warnings in the durable results.jsonl ledger so successful repositories do not lose warning evidence after the live progress event has passed.

Fixes #248.

Current main already forwards security.run() warnings to live progress, addressing one part of the original report. The remaining gap is persistence: a completed scan with warnings is still recorded as an unqualified completed receipt, and a resumed campaign cannot surface those warnings again.

Changes

• collect every warning emitted by security.run() for an attempt;
• write non-empty warnings to the attempt receipt as warnings while keeping the existing singular coverage warning field compatible;
• replay persisted warnings through onProgress when a completed/incomplete receipt is reused on campaign resume;
• preserve successful complete scans as completed rather than conflating operational warnings with incomplete coverage;
• extend the existing warning regression to verify multiple warnings survive the ledger and a resume does not rerun the repository.

Testing

• bun test --timeout 30000 ./tests-ts/multiscan.test.ts with Bun 1.3.14 — 52 passed, 1 platform skip, 0 failed
• tsc --noEmit — passed
• Prettier check on both changed files — passed
• git diff --check — passed

Risk and rollout

Low. The ledger change is additive and older receipts without warnings remain readable. Scan status, retry behavior, coverage handling, and live warning delivery are unchanged. Resumed campaigns gain warning replay for receipts that include the new field.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-04T10:49:50.731628Z	aafc4cd	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.