fix(cost): coalesce overlapping cost refreshes

[SiavashShams]

Fixes #31.

Summary

ScanCostTracker.refresh() appended every request to a promise chain. When a session-tree traversal exceeded the 100 ms polling interval, timer ticks accumulated full traversals and stop() queued more work behind them.

Track one active refresh and one shared follow-up refresh instead. Calls arriving during an active traversal await the same follow-up, including stop(), while successful and failed traversals both advance or reset scheduler state.

The regression blocks session reads, starts three overlapping refreshes plus stop(), and verifies that only two traversals run. On the baseline it failed after starting a third traversal. A separate case verifies recovery after a traversal error.

Verification

• pnpm dlx bun@1.3.14 test --timeout 30000 ./tests-ts/cost.test.ts — baseline: 14 passed, 1 failed; patched: 15 passed, 0 failed.
• pnpm dlx bun@1.3.14 test --timeout 30000 ./tests-ts — 708 passed, 5 expected skips, 0 failed.
• pnpm run types — passed.
• pnpm run format — passed.
• pnpm run build — passed.
• pnpm pack --pack-destination /private/tmp/codex-security-pack — passed.
• npm_config_cache=/private/tmp/codex-security-npm-cache pnpm run check:package /private/tmp/codex-security-pack/openai-codex-security-0.1.4.tgz — validated the public import, CLI, bundled plugin files, and archive contents.
• git diff --check — passed.

[mldangelo-oai]

Thank you for the original cost-polling fix. The follow-up in #198 includes your exact contributor-authored commit and narrows the change to interval polling while preserving the existing tracker API; it is the preferred working branch for #31. #198 is still a draft and requires the normal review process, so this PR is being kept open for context and attribution.