feat: upload to Codex Security Cloud

[wholley-oai]

Summary

Add publication of completed Codex Security scans to Codex Security Cloud, with explicit single- and multi-scan selection and fail-closed acceptance handling.

Changes

• Add publish scan --to cloud for completed sealed scans, including --dry-run.
• Support interactive selection and repeated --scan or --scan-dir inputs for multiple scans.
• Validate file-backed ChatGPT credentials, canonical scan paths, cancellation outcomes, and complete unique server receipts without automatic retries.
• Add focused publisher, CLI, contract, packaging, and cross-platform path tests.

Review boundary

This PR owns the original Cloud publication slice. The multi-scan extension was isolated, reviewed, and merged into this branch as #632. Retaining that reviewed history avoids reworking the integration and keeps the original and dependent slices independently traceable. Deployment and account enablement are outside this CLI change.

Testing

• pnpm run types
• pnpm run format
• pnpm run build
• Full Bun suite: 1,711 passed, 30 platform-specific skips, 0 failed
• Focused Cloud publication suite: 103 passed, 0 failed
• Packed archive inspection and installed-package smoke test

Risk and rollout

Cloud publication requires explicit file-backed credentials and a complete unique acceptance receipt. Ambiguous failures are never retried automatically. Existing Linear publication remains unchanged. The Cloud destination remains unavailable unless the deployment and account support it.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[kmbroai]

🔥