fix(logs): exclude same-thread events after scan completion

[Drewwb]

Summary

readScanLogs() uses a saved scan's completedAt timestamp to reject independent worker sessions that start after the scan, but it does not apply that same completion boundary to events inside sessions that were already selected. A post-scan prompt runs on the same Codex thread after complete-scan, so its later events can appear in codex-security scans logs as if they belonged to the completed security scan.

Changes

• In src/scan-logs.ts, parse the saved scan's completedAt once, then skip any event whose own timestamp parses to a time strictly after that boundary before it is appended. Events without a parseable timestamp (such as session_meta) and every event at or before completedAt are preserved, and a null/undefined/unparseable completedAt disables the filter, so running-scan and legacy behavior is unchanged.
• Add a regression test in tests-ts/scan-logs.test.ts that puts a during-scan event (12:01) and a same-thread post-completion event (12:03) in the scan's own session with a completedAt of 12:02, and asserts the 12:01 event is kept while the 12:03 event is dropped.

Testing

• bun test tests-ts/scan-logs.test.ts — 8 pass, 0 fail
• pnpm run types — clean
• npx prettier --check src/scan-logs.ts tests-ts/scan-logs.test.ts — clean

Risk and rollout

Low risk. The change only narrows saved-log projection to a scan's recorded lifetime; it never adds events, and events without a timestamp or at/before completedAt are untouched. No public CLI surface, schema, or default changes.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

Fixes #555