fix: allow completion when no draft manifest exists yet (#83)

Fresh recipe-driven scans fail at completion with:

  Could not save the Codex Security scan: scan-manifest.json:
  expected a regular file inside the scan directory.

`workbench_db.complete_scan` reads `scan-manifest.json` with
`required=True` when `scan.recipe_json is not None`, but on a first
completion of a fresh scan there is no prior draft on disk yet — the
draft is authored later by `_write_prepared_scan_finalization`. The
read therefore always raises before the write can happen, and every
retry still throws before writing anything, so `scan_dir` stays empty
and models are billed with no artifacts produced.

Make the pre-write read optional. When a prior manifest is present
(resumed / re-completed scans), preserve the sealed timestamps as
before; otherwise skip that step and let the downstream finalizer
write the draft.

Verified against `pnpm run lint` (tsc --noEmit) and the full
`bun test` suite on the public SDK: 367 pass, 23 expected skips,
0 fail.

Refs #73

Author: onurtirpan

sdk/typescript/_bundled_plugin/scripts/workbench_db.py

@@ -1414,11 +1414,18 @@ def complete_scan_locked(
     completion_timestamp = now()
     completion_binding = workbench_completion_binding(scan, completion_timestamp)
     if scan["recipe_json"] is not None:
-        manifest = read_json_object(artifact_path(scan_dir, ARTIFACTS["manifest"], required=True))
-        manifest_scan = manifest.get("scan")
-        if isinstance(manifest_scan, dict) and manifest_scan.get("sealedAt") is not None:
-            completion_binding["startedAt"] = manifest_scan.get("startedAt")
-            completion_binding["completedAt"] = manifest_scan.get("completedAt")
+        # Fresh recipe-driven scans have no prior scan-manifest.json on disk — the
+        # draft is authored later by _write_prepared_scan_finalization. Guard the
+        # read so first-time completion does not fail with "expected a regular
+        # file inside the scan directory" (issue #73). When a prior manifest does
+        # exist (resumed / re-completed scans), preserve the sealed timestamps.
+        manifest_path = artifact_path(scan_dir, ARTIFACTS["manifest"], required=False)
+        if manifest_path is not None:
+            manifest = read_json_object(manifest_path)
+            manifest_scan = manifest.get("scan")
+            if isinstance(manifest_scan, dict) and manifest_scan.get("sealedAt") is not None:
+                completion_binding["startedAt"] = manifest_scan.get("startedAt")
+                completion_binding["completedAt"] = manifest_scan.get("completedAt")
     try:
         prepared = _prepare_scan_finalization(
             scan_dir,