Allow scan options during bulk discovery

[dipeshbabu]

Summary

• allow --workers, --mode, --max-attempts, --plugin-path, and --python when starting interactive bulk-scan discovery
• remove the redundant raw-argument whitelist and rely on the typed CLI schema
• retain a focused error for --output-dir, which belongs to CSV-driven bulk scans because the discovery wizard selects its own destination
• add regression coverage for both split and --option=value forms

Root cause

The command schema parsed all bulk-scan options correctly, and the scan runner consumed them after discovery. A second hand-written argv whitelist admitted only --model, --effort, and --codex, so other valid options failed before the wizard started.

Impact

Interactive discovery can now use the same concurrency, mode, retry, plugin, and Python settings as CSV-driven bulk scans. CSV behavior is unchanged.

Overlap check

Open issues and pull requests were reviewed, followed by repository-wide searches for interactive bulk-scan options, workers, retries, plugin paths, and Python configuration. No active issue or pull request overlaps this fix. Issue #45 concerns Docker option ordering with an explicit CSV, and PR #124 is documentation-only.

Validation

• pnpm dlx bun test --timeout 30000 ./tests-ts/cli.test.ts — 85 passed
• pnpm exec tsc --noEmit
• pnpm exec prettier --check src/cli.ts tests-ts/cli.test.ts
• git diff --check