refactor(plugin): share checked SECURITY.md inputs

[mldangelo-oai]

Summary

Extract the shared policy-input handling from #536 so it can be reviewed independently of model orchestration and the CLI.

Changes

• Extend the bundled SECURITY.md resolver with scoped inventory and checked drafting inputs.
• Reuse one filesystem-aware containment and file-reading path for inherited policies, selected policies, and separate reporting guidance.
• Keep Git metadata and unsafe policy links out of the inputs. Add focused cross-platform regression coverage.

Testing

• Focused resolver tests: 8 passed.
• Full Bun suite, seed 12345 and default seed 4058553103: 1,351 passed, 23 skipped, 0 failed in each run.
• pnpm run types, pnpm run format, pnpm pack, and the installed-package checker: passed.
• Three fresh native Codex reviews and an independent verifier: no confirmed actionable findings on d9e69cfa.

Risk and rollout

The existing resolver modes remain available. This adds no model calls, repository writes, dependencies, or package release. Later PRs add SDK drafting and the CLI.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[mldangelo-oai]

@codex review

Please review the current head, d9e69cfaebcca679312571689410d8b57f2c36ae, against main.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d9e69cfaeb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Limit hard-link rejection to the editable policy

When any inherited SECURITY.md has another hard link—even another name wholly inside the repository—st_nlink > 1 now makes the existing --scope resolver fail instead of reading the regular file. Hard-link protection is relevant when --inspect selects a file that may later be edited, but applying it in the shared read path unnecessarily breaks read-only scans for repositories that deduplicate or share policies with hard links; keep this check on the selected edit target rather than all policy reads.

AGENTS.md reference: AGENTS.md:L9-L9

Useful? React with 👍 / 👎.