fix(plugin): include Solidity sources in scan inventories - #1021

Summary

generate_in_scope_files.py and generate_rank_input.py filter changed and ranked paths through TEXT_CODE_EXTENSIONS in rank_preview.py, which does not include .sol. A diff that changes only Solidity files produces an empty inventory: the helper exits 0 with "Recorded 0 in-scope files.", and prepare_codex_security_review_items returns zero review items for the diff scan. Repository and diff rank inputs also omit .sol files. Full-repository inventories are unaffected because they are not filtered by extension.

Changes

• Add .sol to TEXT_CODE_EXTENSIONS. Previews use the existing sampled-text path, as for .tf and .m, because the structural outline parser has no Solidity declaration rules.
• Add diff inventory tests for revisions and local-patch modes.
• Add rank input tests for repo, revisions, and local-patch modes.
• Add Vault.sol to the sampled-text preview byte-budget test.

Testing

• The new inventory and rank input tests fail on main (5 failed) and pass with the change. The Vault.sol preview case passes on both and pins the sampled-text path.
• python -m ruff check and python -m ruff format --check with the pinned ruff: pass.
• pnpm --dir sdk/typescript run build:ci: pass.
• node .github/scripts/check_plugin_source_compatibility.mjs: pass.
• node --test .github/scripts/test_check_plugin_source_compatibility.mjs: 9 passed.
• python -m pytest plugins/codex-security/tests: 1151 passed, 8 skipped, 109 subtests passed (Linux, Python 3.12).

Risk and rollout

Diff scans and rank inputs now include .sol files, which can increase review items and token use for repositories containing Solidity. No CLI, schema, or output format change.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.