fix(skills): align compact diff validation and attack paths

[mldangelo-oai]

Summary

Make bundled validation, attack-path, artifact, and final-report instructions match the compact candidate lifecycle already used by workbench-backed diff scans.

Changes

• Recognize both Deep scans and workbench-backed diff scans with a scan identifier as compact candidate workflows.
• Record validations, false-positive rationale, and attack-path decisions in existing nested candidate fields without creating duplicate reports or receipts.
• Apply the same candidate outcome, coverage, workbench draft, and completion contract to Deep and workbench-backed diff scans.
• Keep legacy report, receipt, ledger, and local finalizer paths for terminal diff scans without a scan identifier.

Testing

• bun test --timeout 30000 tests-ts/compact-diff-scan.test.ts passed: five tests, including the complete MCP diff lifecycle and suppressed-candidate coverage.
• bun test --timeout 30000 tests-ts/deep-scan-workbench.test.ts --test-name-pattern 'candidate|validation|attack|discovery' passed: 14 tests.
• pnpm --pm-on-fail=ignore run types passed.
• pnpm --pm-on-fail=ignore exec prettier --check _bundled_plugin/references/final-report.md _bundled_plugin/references/scan-artifacts.md _bundled_plugin/skills/validation/SKILL.md _bundled_plugin/skills/attack-path-analysis/SKILL.md passed.
• git diff --check passed.

Risk and rollout

Low risk. This changes bundled instructions and shared references only. Existing Deep scans, terminal diff scans, candidate schemas, workbench ownership checks, evidence preservation, and scan finalization behavior remain unchanged.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[mldangelo-oai]

@codex review

[mldangelo-oai]

@codex security review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2be96c5a27

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: 2be96c5a27

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[mldangelo-oai]

@codex review

[mldangelo-oai]

@codex security review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 👍

Reviewed commit: f7934d8212

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: f7934d8212

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[zcrab-oai]

Looks good. Compact diff validation and attack-path guidance now aligns with the existing candidate lifecycle while preserving SDK-owned completion.