test(workbench): share setup for scan targets and ownership transfers

[mldangelo-oai]

Summary

Simplify tests for selecting a scan target, starting a saved scan, and transferring its ownership to a continuation thread. Reuse the shared workbench command helpers while keeping each scenario's identifiers, settings, operation order, and expected errors explicit.

Changes

• Reuse workspace, scan, coverage, and completion helpers in the database, handoff, and setup tests.
• Preserve environment overrides, literal target paths, expected failures, and the existing assertions at each call site.

Testing

Recorded validation on Python 3.12 exercises the same real workbench subprocesses and temporary SQLite databases through the shared helpers. Concurrent scan-start calls must return the same scan ID and leave exactly one running database row. Concurrent handoff-delivery calls must retain the same ownership token and initial progress state.

Target cases retain checks for literal Git paths, changed working-tree contents, dirty or mismatched submodules, and scopes that escape the selected repository. Ownership cases still reject access from another thread and preserve the rules for releasing and reclaiming a scan.

To repeat, run python -m pytest plugins/codex-security/tests/test_workbench_db.py plugins/codex-security/tests/test_workbench_handoff.py plugins/codex-security/tests/test_workbench_setup_and_migrations.py from the repository root with the Python test dependencies installed.

Risk and rollout

Depends on #1400, which supplies the shared workspace and scan-lifecycle fixtures. This is a test-only refactor. Production target selection, ownership rules, database behavior, and CLI syntax are unchanged; subprocess execution and existing assertions remain in place.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-07T05:24:44.601144Z	c4e0cda	New commits
🔒 Security Review	✅ Completed 2026-10-07T05:25:19.947377Z	c4e0cda	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[zcrab-oai]

Reviewed the diff and relevant surrounding code at 67d8e99, with an independent second pass. No obvious correctness or regression issues found. Full local platform suites were not rerun. CI still has failed or unfinished checks; those results remain separate from this source-review approval.