fix(scan): restore omitted target and scope metadata

[ianw-oai]

Summary

A Standard scan can finish its analysis, then fail to save when the agent omits scan.target or scan.scope. Completion now creates those objects and fills them from the registered workbench metadata.

Changes

• Create omitted target and scope objects before applying registered metadata.
• Fill an omitted target kind only when registration allows exactly one kind. Preserve explicit kinds and existing validation.
• Cover missing and empty targets for directory snapshots, clean Git revisions, and dirty worktrees. Cover missing and empty scopes with exact registered paths, plus omitted workbench-owned metadata.
• Revert the optional inventory-strategy change as requested in review. inventoryStrategy remains required; there are no net schema, report, or SDK changes.

Related: #828 handles an incorrect authored kind but still requires the target object to exist. This change does not replace explicit kinds.

Testing

• Completion, finalizer, and report-projection suites: 251 passed, 2 skipped, and 55 subtests passed.
• Plugin Ruff lint and format checks passed.
• SDK build:ci, types, and format passed, including generated-model checks.
• Plugin source compatibility check and all nine checker tests passed.
• git diff --check passed.
• Verified that the revert restores the exact tree at 120d9fdb, retaining only the target and scope fixes against main.
• Full SDK suite not rerun locally for this revert.

Risk and rollout

No public CLI or coverage-schema changes. Only unsealed drafts with a workbench completion binding get missing target and scope metadata. Sealed hashes, invalid explicit kinds, malformed objects, and required-coordinate checks keep their existing behavior. Ambiguous registered kinds are not inferred. A missing scan object or findings array remains a validation error.

Verification used synthetic local fixtures, not a live model scan. The fix needs a release before CLI users receive it.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-28T22:50:29.007382Z	d60de08	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[mluck-openai]

lgtm