refactor: share semantic audit admission

[mldangelo-oai]

Summary

Use one audit-admission operation for Standard scans and Deep workers. A completed Codex turn produces an accepted result only after its artifacts pass semantic validation; unfinished checkpoints remain incomplete.

Changes

• Share the existing persisted-artifact validation rules, including finding relationships, coverage metadata and scan-relative paths.
• Keep retries, progress, finalization and public result construction with their existing callers.
• Preserve older selected plugins and package the shared parser for standalone installations.

Testing

• At 361340b, SDK types, formatting, package creation and the installed-package checker passed.
• Installed SDK and physically detached plugin controls passed with default Python discovery, a Python-only PATH and an explicit executable path containing spaces. These exercise discovery, reducers, restart and public completion with synthetic fixtures.
• Three independent native reviews and a separate provenance/finding audit passed for this head against refactor: share Codex session execution #917 at 2877c44.
• Earlier full SDK runs recorded 3,113 passes, 50 skips and one pre-existing Git fixture failure per order. Those runs precede the final fixture-only assertion correction; they are supporting evidence, not final-head full-suite passes.
• Final-head platform CI will be linked after publication. No new live-model evaluation was run for this change.

Risk and rollout

Depends on #917. Artifact acceptance and cancellation are sensitive boundaries; package controls cover their public entrypoints. Keep this PR unmerged until its dependency and platform checks are reviewed. This change adds no public command, setting or result field.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-16T23:37:55.240988Z	361340b	Draft marked ready
🔒 Security Review	✅ Completed 2026-09-16T23:39:35.342058Z	361340b	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.