feat: support per-scan Cyber access programs

[mldangelo-oai]

Summary

API-key scans can select a Cyber access program without dropping it before the API request. The same selection reaches fresh and resumed Deep Scan workers, automatic component planning, and finding matching.

Fixes #1024. Uses the dependency update merged in #1184.

Changes

• Add --cyber-access-program standard|daybreak_blue|daybreak_red to scan and scan-components, SDK cyberAccessProgram, and project setting scan.cyber_access_program. All are optional and omitted by default.
• Forward selection through planning, scans, finding matching (including catalogue and evidence turns), custom validation, post-scan work, and workers; retain it in saved resume/rerun recipes.
• Enable upstream API-key Cyber support for explicit selection while respecting an explicit native disable. Snapshot effective worker settings per scan and preserve concurrent-scan isolation.
• Update help, generated schema, documentation, and regression coverage.

Testing

• Focused regressions cover CLI/configuration resolution, every scan turn, completed-scan matching, saved resume/rerun settings, and concurrent-scan isolation.
• Real SDK worker-launch tests cover fresh/resumed discovery and reducer workers, effective gates, and intentional worker overrides.
• All five portable plugin checks, SDK type checks, formatting, and builds passed.
• All 23 CLI/SDK request-level QA scenarios passed against a loopback Responses server with synthetic keys, covering the upstream packages, built scans, automatic planning, and matching; all program values, omission, explicit feature disable, and denied API access were exercised. CLI authorization wording remains unchanged; SDK errors retain the upstream denial.
• Three independent native code reviews and a fresh verification pass found no actionable issues.
• Full SDK regression commands: pnpm run test --seed 12345 and pnpm run test. Cross-platform results are recorded in the PR checks.

Merge validation (46a046b882): merged current main, retained per-scan isolation assertions alongside the updated promise helper, and passed all five portable plugin checks, SDK types/formatting, the Deep Scan executor tests, and focused Cyber/authentication/concurrency tests. Fresh cross-platform CI passed with 56 successful checks and 4 skipped checks, including code and security review. One macOS runner DNS failure during Node setup cleared on retry. The local full-suite attempt was stopped after host-specific filesystem fixture failures; full-suite validation came from CI.

Risk and rollout

Uses the Codex prerelease dependency already present on main. Omission preserves existing defaults. Selection is supported by the built-in OpenAI provider; server-side entitlements still apply. QA did not exercise production entitlements.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-02T22:42:56.470718Z	46a046b	New commits
🔒 Security Review	✅ Completed 2026-10-02T22:42:49.379760Z	46a046b	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[kmbroai]

Reviewed API-key program selection, saved resume settings, and fresh/resumed Deep Scan propagation. The focused worker-launch and read-only helper tests passed locally; full CI passed on this head. Production entitlements were not exercised. No blocking findings.