feat(wiz): import repository vulnerability CSV reports

[mldangelo-oai]

Summary

Import Wiz Code repository package-vulnerability CSV reports through the existing codex-security publish findings command. The adapter keeps occurrence IDs and every original cell, verifies the source repository, and preserves saved requests across retries and reordered columns.

Changes

• Recognize the supported comma-separated Wiz vulnerability profile in plain, BOM-prefixed, or gzip-compressed input. Parse quoted multiline cells and retain unknown columns as source evidence.
• Map reported package, severity, advisory, and location fields without inventing a branch, revision, update timestamp, or assessment. Reject damaged CSV and duplicate occurrence IDs; surface unsupported rows in the preview.
• Verify GitHub repository-branch URLs against the selected destination, including explicit ports and normalized JSONL round trips.
• Keep JSONL parsing on its existing path, including large reports, and include the new parser in package validation. Update CLI help, documentation, and the bundled publication skill.

Testing

• 266 focused adapter/publication tests passed with 7,940 assertions; TypeScript/model checks and formatting passed.
• Pinned Ruff checks, SDK build, portable plugin compatibility, and all 9 portable-source tests passed.
• All 38 package-listing tests passed with the repository's 30-second timeout. Built the final archive and passed both check-package.mjs and smoke-package.mjs, including installed SDK, CLI, and plugin lifecycle checks.
• Both full test orders completed with 5,160 passes, 75 skips, and 1 failure each (89,503 assertions). The sole installed-hook failure also reproduces on unchanged main 05ff204e; security hooks were left intact. These runs used 22a9a84d, whose runtime and test trees are identical to the final commit. The only later change is the package allowlist entry, covered by the final-head archive and package tests.
• Three fresh code reviews and independent verification found no actionable issues.

Risk and rollout

Stacked on #1441. The accepted CSV profile is limited to GitHub repository-branch package vulnerabilities; other CSV profiles require an explicit mapping. Existing JSON and normalized JSONL inputs remain supported. Regression coverage includes 150,000-record JSONL under a 256 MiB Node heap, source repository mismatches, immutable retries, malformed reports, and opaque evidence cells. Hosted CI must qualify this PR before merge; this change does not establish live Cloud import or deployment.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.