feat(sdk): prepare sealed security scans for publication

[kmbroai]

Summary

Prepare completed, sealed security scans for destination-neutral publication while preserving the existing scan and finding provenance.

Changes

• Validate sealed scan artifacts before preparing publication payloads.
• Render one deterministic issue per finding, using the scan ID as the publication ID and [Codex Security][SEVERITY] titles.
• Keep scan-ID provenance in issue descriptions without repeating a redundant Upload ID.
• Preserve truthful scan-mode provenance for all seven schema-supported coverage modes, including path, commit, branch-diff, and working-tree scans.
• Include source-code evidence, affected locations, repository and coverage metadata, remediation, and safe immutable source links.
• Support a required Linear team with an optional project, omitting the project identifier entirely for team-only publication.
• Add the new compiled module to the public package allowlist.

Testing

• bun test tests-ts/publication.test.ts: 20 passing tests and 106 assertions, including real resealed fixtures for all seven supported coverage modes and a team-only destination.
• tsc --noEmit: passed.
• Built, packed, and installed this stack layer independently; the package allowlist and installed-package smoke passed.

Risk and rollout

• This foundation does not contact external services or create issues.
• Source-code snippets remain explicit publication data for a later connected-app integration.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[soyeon-oai]

Reviewed the exact PR delta. I found one publication-provenance issue.