build(plugin): bundle verified native runtime artifacts

[kmbroai]

Summary

Include verified native OS primitives in the standalone plugin and npm package so TypeScript helpers can run without compiling or downloading native code at runtime.

Changes

• Assemble all eight Linux, macOS, and Windows payloads through reusable workflows and supply them to package, test, release, and container jobs.
• Copy the complete native tree and dependency notices from the single inventory in plugin-files.json. Missing declared inputs fail the build; undeclared files are excluded.
• Check installed native loading with an empty PATH and link artifact preparation before both README source-build recipes.
• Use asynchronous subprocesses in two runner tests while preserving their assertions and deadlines.

Testing

• Six builder tests, Ruff, portable source checks, all nine checker tests, and README formatting passed.
• In separate fresh source snapshots initially lacking native inputs, downloaded the verified universal artifact and completed both the SDK build and Docker scanner build. Both findings API smoke tests returned HTTP 200; the Docker test used an available loopback port.
• Direct-builder checks verified the exact manifest inventory, rejection of a missing declared native input, and exclusion of an undeclared input.

Risk and rollout

Stacked on #796. Adds about 3.8 MB of native binaries and notices before compression. Source builds require the documented prebuilt inputs. Hosted CI covers universal artifact assembly and downstream platform jobs. Product helpers switch to TypeScript in subsequent changes.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-04T22:48:36.913243Z	bd11e36	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.