fix(cli): preserve repository protections in artifact exports

[mldangelo-oai]

Summary

Keep the existing SARIF export workflow and preserve its repository protections when an output path uses a directory alias or --source-root points to a separate checkout.

Related: #1571, #1572.

Changes

• Preserve repository-owned symlink checks through directory aliases, including case-insensitive paths and native Windows path resolution.
• Protect both the caller's directory and the SARIF source checkout when selecting Python for scan lookup and export, including inherited and configured interpreter paths.
• Lead the README with one export example. Group the CLI reference by task and explain source fingerprints, retries, and CI export steps alongside the relevant examples.
• Reuse the existing scan --output-dir and export interfaces. No new command, flag, or default.

Testing

• Export and adjacent history/Deep Scan CLI tests: 107 passed, 2 platform-specific skips. Six new lookup cases reproduced the issue before the fix and passed afterward.
• SDK type checks, formatting, and build passed.
• Documentation formatting, internal links, and example flags checked against built CLI help.
• Three fresh native reviews of the committed PR diff, with independent verification: no actionable findings.
• Full CI results are available in the PR checks.

Risk and rollout

No scan-lifecycle or worker-setting changes. The runtime fixes preserve existing export protections. Automatic SARIF export can fail without failing the scan; explicit export reports errors and can be retried from saved results.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-17T18:32:14.255823Z	badf04a	New commits
🔒 Security Review	✅ Completed 2026-10-17T18:33:22.512319Z	badf04a	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Something went wrong. Try again later by commenting “@codex review”.

An unknown error occurred

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[kmbroai]

Could we name this --sarif-output instead? --sarif results.sarif feels unintuitive and reads like an input flag, especially since scan import --json/--csv take input files. The existing export command uses --export-format sarif --output FILE, and the Python helper already uses --sarif-output. Making the output destination explicit would be clearer.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 660a222a5c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".