Saved scan logs include same-thread events emitted after scan completion

Summary

readScanLogs() uses a saved scan's completedAt timestamp to reject independent worker sessions that start after the scan, but it does not apply the same completion boundary to events inside sessions that were already selected.

A post-scan prompt runs on the same Codex thread after complete-scan, so its later events can appear in codex-security scans logs as if they belonged to the completed security scan.

Reproduction / evidence

Current upstream main at 37bf87a692fc72d41f7312cc48808d699d204fba does this in readScanLogs():

• belongsToScan() parses completedAt and excludes independent sessions whose startedAt >= completedAt;
• after the session set is selected, the event loop appends every event from each included session without checking completedAt.

The SDK scan lifecycle completes/persists the scan first, then, when postScanPrompt is configured, invokes the follow-up on the same thread through runPostScan.

A deterministic saved-log fixture is therefore:

1. root session starts at 12:00:00;
2. a scan event is timestamped 12:01:00;
3. saved scan completedAt is 12:02:00;
4. a same-thread post-scan event is timestamped 12:03:00;
5. readScanLogs() currently returns both events.

Expected behavior: the 12:03:00 event is outside the saved scan's lifetime and should not be projected as scan activity.

Root cause

The completion boundary is enforced only while deciding which independent sessions belong to a Deep scan. It is not enforced at the per-event projection boundary for root, child, or already-selected worker sessions.

Suggested fix

Parse a finite completedAt once for log projection and omit timestamped events strictly after that instant. Preserve existing behavior for running scans (completedAt: null) and for legacy events that do not carry a usable timestamp.

Add a focused regression with before/after completion events in the same root session.

Impact

This is history/observability correctness. scans logs can mix post-scan assistant/tool activity into the evidence shown for a completed scan, making the saved activity timeline extend beyond the scan record it claims to describe.

Start at readScanLogs() and its belongsToScan() session selection, then inspect runPostScan in the complete-scan lifecycle. Add the focused same-root-session fixture with events before and after completedAt; done means post-completion events are omitted while running scans and untimestamped legacy events retain existing behavior.