Run warnings never reach the SARIF projection, so drift is invisible to SARIF consumers

Summary

A scan whose target drifted mid-run records a warning, but that warning never reaches the SARIF projection, so a SARIF consumer cannot tell the results describe a stale tree.

Environment

• @openai/codex-security 0.1.5, current main at ea19f24
• macOS 15 (Darwin 25.5.0), Python 3.14.5

Where it is

sdk/typescript/_bundled_plugin/scripts/finalize_scan_contract.py populates runs[].invocations[].toolExecutionNotifications from coverage["deferred"], and only when coverage["completeness"] is not complete.

A drifted target leaves completeness at complete — the scan really did review everything it set out to review; the tree simply moved underneath it. So the condition is false, no invocations block is emitted at all, and there is no field carrying the warning.

Why it matters

SARIF is the machine-readable surface most CI systems consume, and toolExecutionNotifications with level: "warning" is precisely the SARIF idiom for "the run completed but something about it needs attention". A drift warning is the clearest example of that, and it is the one place it cannot currently appear.

Note this is not a projection bug alone — the notification structure is only ever built from deferred coverage rows, so run-level warnings have no route into SARIF regardless of completeness.

Suggested direction

Emit an invocations[] entry whenever the scan recorded warnings, independently of completeness, mapping each warning to a toolExecutionNotifications entry at level: "warning" with executionSuccessful: true. That leaves the existing deferred-coverage notifications untouched and adds the run-level ones alongside.

This needs a bundled-plugin change plus SARIF schema validation, which is why it was kept out of PR #220 (that PR states it makes no export change). Related: #195.

Start in sdk/typescript/_bundled_plugin/scripts/finalize_scan_contract.py and trace how coverage["deferred"], completeness, and recorded warnings become SARIF runs[].invocations[].toolExecutionNotifications. Check the existing deferred-coverage behavior, then use the SARIF schema validation to verify that run-level warnings appear with warning severity and executionSuccessful true while deferred notifications remain unchanged.