refactor(plugin): initialize workbench databases with Node SQLite - #1335

Summary

The workbench stores scans and findings in SQLite. Initialize that database with Node's built-in SQLite so findings-store startup and database-info can work without Python. Other workbench operations continue to use Python and the same database.

Changes

Reuse the shared migration history and legacy repairs, preserving saved results, complete diagnostics, and transaction errors. Keep existing directory links and permissions; create missing storage privately, including Windows access controls. The SDK resolves the state directory once and uses its trusted Node selection when running under Bun.

Initialization captures the state directory, environment, and original executable-trust context. Relative Python paths retain their original location if the caller changes directories. Python discovery stays lazy until a legacy command runs, then caches the validated executable; a missing explicit interpreter does not prevent Node initialization.

Testing

Checks on Node 22.13 and Node 24 upgraded every released schema through version 42, including editable scan names, to the same current schema, then repeated the upgrade without changing migration history. Workflow fixtures retained embedded-NUL diagnostics and large integer values. A forced storage failure preserved the original error and pre-upgrade data. Concurrent-access cases kept an up-to-date reader usable during a write and retried an upgrade after a held lock.

SDK fixtures initialize two stores concurrently with Python configured to a missing executable, then verify the shared database path. Additional fixtures check that Python operations see the same stored findings and that Bun ignores a repository-local Node shim.

With dependencies and the host's plugin/native bundle built, repeat the database scenarios using node --experimental-strip-types --test tests/test_workbench_database.ts from plugins/codex-security/mcp-app.

Portable plugin checks, SDK build/types/format, build-plugin fixtures, and focused runtime/Deep Scan worker checks pass. The latest fix passes 35 findings-store tests, 93 focused runtime tests, and 11 executable-trust tests. Regressions cover state-location changes, changing directories before and after the first Python operation, an unavailable explicit interpreter, and rejection of an executable from the original repository. Full SDK-suite coverage is reported at the stack tip.

Risk and rollout

Depends on #1333. Node remains 22.13 or newer within supported major versions. Preserve Python database compatibility, foreign keys, concurrent readers, lock retries, path handling, and terminal-control escaping. No public flags are added. The recorded local tests do not establish behavior on every supported platform or packaging path.

Related PRs

Merge order: #1333 → #1335 → #1341 → #1342 → #1343 → #1397 → #1408

• This PR: 2 of 7.
• Base: #1333
• PRs above: #1341, #1342, #1343, #1397, #1408

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.