test(workbench): share setup for completing scans and exporting findings - #1413

Summary

Tests for completing scans, preserving stopped results, and exporting findings repeat command arguments and saved-draft setup. Reuse shared helpers so each test can focus on its inputs and expected results.

Changes

Use the shared scan and workspace commands in completion, database, export, and paging scenarios. Reuse coverage and draft helpers. Keep the scenarios' explicit data and behavior assertions. Shared workspace setup and fixture-option cleanup are already on main; the remaining diff removes 238 net lines.

Testing

Recorded Python 3.12 runs used temporary repositories, SQLite databases, and workbench command subprocesses to verify that:

• Completion binds results to the selected diff snapshot, repeated completion preserves sealed artifact bytes, and concurrent completion records a finding only once.
• Invalid drafts remain repairable. Failed or canceled scans retain findings and JSON, CSV, and SARIF exports; changed sealed manifests and symlinked export directories are rejected.
• A scan with 75 synthetic findings returns bounded, non-overlapping pages and can retrieve a selected finding beyond the first page.

The updated main-based branch passed all 237 focused tests with Python 3.12. Full-plugin Ruff lint and formatting, the SDK CI build, the plugin source compatibility check, and all 9 checker tests also passed. Repeat from plugins/codex-security with Python test dependencies installed:

python -m pytest -q --tb=short tests/test_workbench_completion_binding.py tests/test_workbench_db.py tests/test_workbench_db_exports.py

Cross-platform validation was not run locally.

Risk and rollout

Uses the Deep Scan startup and recovery fixtures from merged #1402, now in main. This changes test setup only. The main risk is accidentally changing fixture inputs for completion and exports; production commands and database behavior are unchanged.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.