fix(deep-scan): exclude unconsumed partial findings from successful results

[msapelov]

Summary

Prevent incomplete artifacts from unconsumed Deep Scan discovery workers from adding unmatched top-level findings after a successful canonical reducer has completed.

Successful Deep Scan completion now keeps the reducer result authoritative while retaining stopped-scan loss recovery and represented worker evidence.

Fixes #717

Changes

• Use merge_state == "merged" as the persisted signal that a discovery worker participated in the successful reducer lineage.
• Prevent unmatched findings from unconsumed discovery artifacts from expanding a successful parent result.
• Continue allowing those artifacts to enrich findings already represented by the canonical result.
• Prevent unconsumed incomplete artifacts from downgrading successful canonical coverage or contributing coverage collections.
• Preserve the existing loss-preserving union for failed, canceled, and interrupted parent scans.
• Add deterministic coverage for current checkpoints, archived checkpoints, archived incomplete results, omitted workers, represented evidence, and stopped-parent recovery.

Testing

• Focused saved-result regressions: 8 passed.
• Complete saved-result suite: 54 passed.
• Full plugin suite: 1044 passed, 5 skipped, plus 104 subtests.
• pnpm run check:plugin-source: passed.
• pnpm run types: passed.
• pnpm run format: passed.
• pnpm run test:mcp: passed.
• pnpm pack: passed.
• git diff --check: passed.
• pnpm run test:ci: 2028 passed, 31 skipped, with 3 unrelated failures previously reproduced on the base.
• Package smoke validation was blocked by the existing dependency publication-date cutoff for @openai/codex@0.149.1; package creation itself passed.

Risk and rollout

The behavior change is limited to successful Deep Scan finalization when a valid canonical reducer result exists.

Reducer-consumed discovery artifacts retain their existing recovery behavior. Unconsumed artifacts remain preserved in saved-source metadata and may enrich represented findings, but cannot introduce unmatched top-level findings or coverage entries.

Failed, canceled, and interrupted parent scans retain the loss-preserving behavior introduced by #617. No schema migration or persisted-state change is required.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.