fix(publish): explain findings before scan details

[ianw-oai]

Summary

Finding descriptions can start with library details or scan metadata before they explain what happens in the product. This change puts the user action and its effect first, then explains the cause, proposed fix, and validation limits.

Changes

• Start finding descriptions with how to reproduce the issue and its effect on the product. Explain the code behind that behavior in plain language.
• Put the finding summary and available reproduction summary before metadata in Linear descriptions. Include validation details and show identical limitations once. Preserve source evidence and scan identifiers.
• Add regression coverage with a synthetic archive-import fixture.

Testing

• After the wording-only follow-up, Markdown formatting, plugin generation, tracking skill validation, and git diff --check passed.
• Before that follow-up, 246 focused tests passed on the rebased commit with Bun 1.3.14. These cover publication, Cloud export, CLI publication, finding contracts, and plugin generation.
• pnpm run check:plugin-source and pnpm run build:plugin: passed. The generated plugin remains untracked.
• pnpm run types, pnpm run format, and pnpm run build: passed on the rebased commit.
• Before the rebase and final prose-only cleanup, full suite runs with seeds 12345 and 2418296050 each passed 1,773 tests, with 30 skipped and no failures. The full suite has not been rerun after the rebase.
• Built CLI publication dry run with the bundled synthetic scan: passed; no issues created.
• Tracking skill validation and git diff --check: passed.

Risk and rollout

No commands, options, schemas, severity rules, or publication permissions change. Existing sealed scans keep their original wording. New scans can carry the revised wording to Cloud, but this change does not alter the Cloud exporter or Cloud display order. The Markdown layout change applies to Linear.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-08-27T23:32:07.618831Z	40ec66a	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[soyeon-oai]

Could you post one example report generated after this change in PR comment? Others LGTM