test: make delivered scan fixtures explicit

[mldangelo-oai]

Summary

The workbench test command helper silently marked pending scans as delivered before certain mutations. That fixture repair could hide failures in the handoff ownership rules. Make the setup explicit so test commands exercise the state the test actually created.

Changes

• Keep run_workbench as a plain command invocation with no database changes.
• Add start_delivered_scan for lifecycle tests that intentionally model an unclaimed, delivered scan, and move those tests to it.
• Keep handoff and claim tests on the real start path. Assert that rejected tokenless mutations leave the pending handoff unchanged.
• Remove the helper opt-out and a now-redundant manual database update.

Testing

• Full Python suite: 1,067 passed, 5 skipped, and 104 subtests passed.
• Focused handoff, progress, completion, Windows backend, and cancellation tests passed.
• Ruff lint and format checks passed for the plugin and compatibility scripts.
• Checked that the mechanical call-site changes leave the rest of each test unchanged.

Risk and rollout

Test-only change; no production behavior, database schema, or ownership policy changes. Tests that require a delivered scan now declare that fixture at creation. Handoff tests continue to use production transitions.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-30T01:32:18.920209Z	86c8cba	Manual request
🔒 Security Review	✅ Completed 2026-08-30T01:26:28.105768Z	86c8cba	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[mldangelo-oai]

@codex review

Please review the current head, 86c8cba.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: 86c8cba3b2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".