feat(wiz): import repository vulnerability CSV reports

[mldangelo-oai]

Summary

Import Wiz Code repository package-vulnerability CSV reports through codex-security publish findings. The adapter retains occurrence IDs and every original cell, checks the source repository, and preserves requests across retries and reordered columns.

Changes

• Parse the supported comma-separated Wiz vulnerability profile in plain, BOM-prefixed and gzip-compressed reports, including quoted multiline cells and unknown columns.
• Map reported package, severity, advisory and location fields. Keep branch, revision, update time and assessment unset when the export does not establish them; reject damaged CSV and duplicate occurrence IDs, and show unsupported rows in the preview.
• Check GitHub repository-branch URLs against the destination, including explicit ports and normalized JSONL round trips. Preserve the existing JSONL path for large reports.
• Combine CSV support with the Snyk, Endor and Semgrep adapter stack while retaining their provider registrations. Update the CLI help, publication skill, documentation and package allowlist.

Testing

• 453 focused adapter/publication tests passed with 9,152 assertions. Types/model checks, formatting, SDK build, pinned Ruff, portable source compatibility and all nine portable-source checker tests passed.
• The final 654-entry archive passed check-package.mjs, including installed SDK/CLI/plugin lifecycle, native Node, credential locking, hosted scan protocol, worker retry and detached plugin restart checks.
• Both full SDK orders completed on this exact commit: seed 12345: 5,347 passes, 75 skips and 1 failure; seed 1902141116: 5,347 passes, 75 skips and 1 failure. The sole installed-hook failure was separately reproduced on unchanged parent f9771602 with the same runtime. These full runs are not reported as green; security hooks remain intact.
• Three independent code reviews and a separate verifier found no actionable issues for this base and head.

Risk and rollout

Stacked on #1690. This CSV profile covers GitHub repository-branch package vulnerabilities; other CSV profiles need an explicit mapping. Regression coverage includes 150,000-record JSONL under a 256 MiB Node heap, repository mismatches, immutable retries, malformed reports and opaque evidence cells. Current-head hosted CI and dependency readiness remain required before merge. Live Cloud CSV upload and readback are not established by these local checks.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[alandelong-oai]

Thanks for the focused CSV support. Owner-level merge-safety review of 8b13847af569 against f9771602e0b3: no material findings. The adapter retains occurrence IDs and original cells, preserves the existing JSON/JSONL path, and checks repository provenance before upload, including normalized round trips. This remains stacked on #1690.

Types, formatting, builds, portable checks, package contents, and a compiled-package CSV parsing/preparation smoke passed; current-head hosted CI is also green. Local durable publication/retry tests are limited by fixture-directory ownership checks; representative failures reproduce on the unchanged parent. Live Cloud CSV upload/readback was not exercised.