refactor: share semantic audit admission

[mldangelo-oai]

Summary

Use one audit-admission operation for Standard scans and Deep workers. A completed Codex turn produces an accepted result only after its artifacts pass semantic validation; unfinished checkpoints remain incomplete.

Changes

• Share the existing persisted-artifact validation rules, including finding relationships, coverage metadata and scan-relative paths.
• Keep retries, progress, finalization and public result construction with their existing callers.
• Preserve older selected plugins and package the shared parser for standalone installations.

Testing

• At 361340b, SDK types, formatting, package creation and the installed-package checker passed.
• Installed SDK and physically detached plugin controls passed with default Python discovery, a Python-only PATH and an explicit executable path containing spaces. These exercise discovery, reducers, restart and public completion with synthetic fixtures.
• Three independent native reviews and a separate provenance/finding audit passed for this head against refactor: share Codex session execution #917 at 2877c44.
• Earlier full SDK runs recorded 3,113 passes, 50 skips and one pre-existing Git fixture failure per order. Those runs precede the final fixture-only assertion correction; they are supporting evidence, not final-head full-suite passes.
• Final-head platform CI will be linked after publication. No new live-model evaluation was run for this change.

Risk and rollout

Depends on #917. Artifact acceptance and cancellation are sensitive boundaries; package controls cover their public entrypoints. Keep this PR unmerged until its dependency and platform checks are reviewed. This change adds no public command, setting or result field.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.