fix(plugin): preserve parent deny rules in Deep Scan workers

[ianw-oai]

Summary

Carry supported parent filesystem denials into a read-only Deep Scan worker profile.

Changes

• Update the bundled MCP runtime from 0.1.146 to 0.1.148.
• Preserve literal deny paths, deny globs, and glob depth without inheriting write grants or command network access.
• Check the selected profile before each worker turn and reject profile fallback.
• Explain required Codex support without recommending a broader sandbox.
• Keep Windows executable resolution tied to the original working directory.

Testing

• Full SDK suite on a local combination of all seven separate ports: 1,511 passed, 29 skipped, zero failures; randomized seed 1019194479.
• Parent-policy, Windows executable, and runtime tests: 128 passed, 10 platform skips.
• Updated the existing cancellation fixture for the permission-profile setup. All 9 focused policy, executable, and worker-shutdown tests passed, including rejection before worker startup when preflight fails.
• Types, formatting, and whitespace checks passed.
• Tested literal TOML keys, denied globs, unsupported parent policies, and Windows executable fallback.
• Windows Node 24 shard 6 still fails the unchanged scan-history test with Python ETIMEDOUT after retry. The same test and error occur on the base commit. The new worker tests passed. No merge conflict is present.
• A local combination of the separate ports passed types, formatting, package build, and installed-package checks (111 plugin files and nested-worker startup).

Risk and rollout

Depends on #595. No npm or plugin manifest version change. The selected Codex executable must support permission-profile checks. No live model scan or native Windows run was performed locally.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-08-21T06:57:33.526938Z	6c235b2	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.