feat(codex-security): allow Deep discovery model overrides

[daneschneider-oai]

Summary

Allow Deep Security Scan discovery workers to use optional model and reasoning effort settings. Unset settings continue to inherit the parent scan's choices.

Changes

• Read discovery_model and discovery_reasoning_effort from [deep_scan] configuration, snapshot the selected values when a scan starts, and persist them in nullable migration 42 columns for resumed runs.
• Apply each configured setting only to discovery SDK workers, including resumed threads. Reducer workers keep the parent scan's model and reasoning effort.
• Preserve the existing run-state shape when the optional settings are absent. Update tests, configuration guidance, and the MCP package version.

Testing

• Python suite: 1,127 passed, 5 skipped, 110 subtests passed.
• MCP suite: 23 test files passed; SDK and MCP TypeScript typechecks passed.
• Ruff lint and format, Prettier, plugin source compatibility, and source packaging checks passed.
• Built the SDK tarball and validated its 415 archive entries with the plugin contract.
• The optional installed-package smoke check did not complete: its npm install reached the script's 120-second timeout. The archive validation above completed independently.

Risk and rollout

The migration adds nullable columns and keeps existing Deep Scan defaults. Existing scans without overrides continue inheriting their parent settings; configured scans preserve their values on resume. The model and effort values are passed to the existing Codex SDK worker options. This draft is ready for owner review and the repository's CI checks before merge.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-07T06:02:56.815701Z	723ead0	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.