Code-fenced status markers can be reported as live scan progress

Summary

The scan progress parser can treat marker text inside Markdown code fences as live progress/status.

There are two related parser gaps in sdk/typescript/src/worker-progress.ts.

Progress markers

scanProgressUpdatesFromEvent() tracks fences with a single boolean and flips it for every line beginning with backticks:

let codeFence = false;
for (const line of output.split(/\r?\n/u)) {
  if (/^\s*```/u.test(line)) {
    codeFence = !codeFence;
    continue;
  }
  ...
}

Markdown fences may use more than three backticks. In this valid shape:

````markdown
```text
CODEX_SECURITY_SCAN_PROGRESS {"phase":"discovery","filesCompleted":8,"filesTotal":8}
```

an inner three-backtick line does not close the outer four-backtick fence, but the boolean parser toggles to `false`. The marker that follows is therefore emitted as live progress even though it is still quoted code.

### Worker-status markers

`dispatchStatus()` filters every agent-message line beginning with `CODEX_SECURITY_WORKER_STATUS` and does not perform any fence tracking. A documented/example marker in an ordinary fenced block can therefore be emitted as a real dispatch update.

## Expected behavior

Only markers outside Markdown fenced code blocks should affect scan progress or worker status. A closing fence should use the same marker character and at least the opening fence length; shorter nested-looking fences must remain content.

## Impact

Quoted workflow documentation, source excerpts, or model explanations can produce false phase/file counts or worker dispatch state in observers and progress UI.

## Suggested fix

Share a small fenced-line filter between progress and dispatch parsing. Track the opening backtick/tilde character and run length rather than toggling a boolean, and add regressions for a four-backtick outer fence plus ordinary fenced worker-status examples.

Start in sdk/typescript/src/worker-progress.ts by reading scanProgressUpdatesFromEvent() and dispatchStatus(). Add regressions for four-backtick outer fences and ordinary fenced worker-status examples, then verify that only markers outside fenced blocks produce progress or dispatch updates.