Add admin dry-run plugin scan jobs

[jesse-merhi]

Summary

Adds an admin-only dry-run scan job system for plugin package releases so scanner changes can be tested against stored artifacts without mutating package moderation state.

Changes

• Adds Convex tables, job processing, pruning, and bounded filesystem evidence collection for package dry-run scans.
• Adds admin HTTP endpoints under /api/v1/packages/-/dry-run-scans for start, status, and paginated results.
• Adds clawhub-mod plugins dry-run-scan start/status/watch/export commands.
• Adds shared API schemas, docs, and a spec note for dry-run scan invariants.
• Expands text-file handling for .mts and .cts files and escapes terminal control characters in CLI error output.

Validation

• bun run format:check
• bun run lint
• bun run test convex/lib/packageDryRunFilesystemScan.test.ts convex/packageDryRunScans.test.ts convex/httpApiV1.handlers.test.ts packages/clawhub-mod/src/commands/packages.test.ts packages/schema/src/schemas.test.ts
• bunx tsc --noEmit --pretty false
• bunx tsc -p packages/schema/tsconfig.json --noEmit --pretty false
• bunx tsc -p packages/clawhub/tsconfig.json --noEmit --pretty false
• bun run --cwd packages/clawhub-mod test
• bun run --cwd packages/clawhub-mod typecheck
• bun run --cwd packages/clawhub-mod build
• cd packages/clawhub && bunx vitest run src/cli/ui.test.ts
• git diff --check

Review

Cold review loop reached 3 consecutive clean passes after fixing two findings: blank CLI selector values and comma-declarator scanner alias coverage.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clawhub	Ready	Preview, Comment	May 13, 2026 0:38am

[jesse-merhi]

Superseded by narrower scanner-only PR #2189.