refactor(mcp): simplify internal Deep Scan state and finding caches - #1352

Summary

Simplify the plugin's internal Deep Scan state without changing saved scan data. The coordinator adapter stops copying fields it never uses, and the result-merging worker keeps each finding in one cache slot instead of retaining both its object and serialized forms.

Changes

• Remove unused phase and canonical-artifact fields from the private MCP run state. Integration tests continue checking canonical artifacts at the workbench response boundary.
• Store each reducer finding and its serialized form in the same cache slot.
• Remove redundant preflight request cleanup and reuse existing coordinator test helpers.

Testing

Recorded focused validation covers the coordinator, store, real workbench integration, permission preflight, and paged finding reads. Integration tests still inspect canonical artifact paths in the actual workbench response and read the resulting files, even though the private adapter no longer copies those fields. Coordinator restart tests check persisted workers and reported progress.

The paging fixture reconstructs large findings containing quotes, Unicode, and prior evidence, then replaces a source file and verifies that the already-bound pages and references stay unchanged. The preflight cancellation test hangs a child during configuration reading, aborts it, and verifies that the child stops.

To repeat after building the plugin bundle, run node --experimental-strip-types --test tests/test_deep_scan_coordinator.ts tests/test_deep_scan_store.ts tests/test_deep_scan_store_integration.ts tests/test_deep_scan_permission_profile_preflight.ts tests/test_artifact_deep_reducer_pages.ts from plugins/codex-security/mcp-app.

After merging current main, all five focused MCP test entrypoints listed above passed, along with the executor, parent-sandbox, and stdio lifecycle test entrypoints. The portable plugin source checks, plugin bundle build, full type checks, and formatting checks also passed. The merge preserves the current runtime settings and diagnostic context; it removes the same redundant cleanup block already covered by this change.

Risk and rollout

No public CLI, persisted workbench schema, or worker settings change. The affected state adapter, reducer paging, and preflight lifecycle are covered by the focused tests. This can ship through the normal release process.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.