Detect and warn from HEAD drifting earlier

I started a security scan and a few seconds later I make sure I was up to dated on the current branch (some files were updated... 🤦 one recent merge... )

I did not realized it would impact the security scan... which then ran for more than ~15 min... before telling me HEAD change -> malformed finding...

It would be nice to advertise the user earlier and detect a HEAD drift if this is going to impact the security scan.

>> ❯ npx @openai/codex-security scan . --model gpt-5.6-terra --effort high --python /usr/bin/python3.12
[00:00] Preparing scan
[00:00] Authentication: stored Codex credentials.
[00:02] Preparing scan
[00:46] Running scan
[00:47] Preflight: worker delegation supported (up to 8 worker slots).
[15:25] Running scancodex-security: warning: Repository HEAD changed while the scan was running; results were saved for the original revision.
codex-security: warning: Skipped malformed finding 1: findings.findings[0].identity: expected an object.

[15:25] Scan complete
codex-security: Findings: 0. Coverage: partial.
codex-security: Elapsed: 923s.
codex-security: Tokens: 28,697,814 input, 26,873,088 cached, 148,144 output.
codex-security: Estimated cost: $13.502247 USD.
codex-security: Report: /root/.codex/state/plugins/codex-security/scans/xxxx/codex-security-xxxx-4vYGZw/report.md
codex-security: Results: /root/.codex/state/plugins/codex-security/scans/xxxx/codex-security-xxxx-4vYGZw
codex-security: Scan coverage is partial; results may be incomplete.

could be related to #20

Start by tracing the scan lifecycle around the existing HEAD-change warning shown in the command output, and compare it with the behavior discussed in issue #20. Reproduce the scan while changing the current branch, then identify where an earlier warning can be emitted before the long-running scan. Done means users are warned promptly when HEAD drifts and the resulting coverage limitation is clear.