fix(plugin): stream tracked diffs while hashing

[Hughhhhcoder]

Summary

Avoid buffering the complete git diff --binary patch in the Python workbench while computing a working-tree content digest. Large changed binaries now use temporary-file storage instead of growing the workbench heap.

Fixes #249.

Changes

• Allow the shared Git runner to direct stdout to a binary file while preserving captured stderr and existing failure behavior.
• Stream the tracked diff into an automatically removed temporary file, frame its exact byte length, and hash it in 1 MiB chunks.
• Add a binary-patch regression that verifies the streaming path and proves the resulting digest is byte-identical to the legacy buffered calculation.

Testing

• python -m pytest -q plugins/codex-security/tests: 1079 passed, 5 skipped, 104 subtests passed.
• Portable Ruff check: passed.
• Portable Ruff format check: 137 files already formatted.
• python .github/scripts/check_plugin_source_compatibility.py: passed.
• git diff --check: passed.

Risk and rollout

The codex-security-snapshot/v1 framing and digest bytes are unchanged. The workbench trades peak Python heap usage for transient local temporary-file storage; the file is removed automatically when hashing finishes. Git process memory usage is unchanged. No CLI, configuration, schema, database, or network behavior changes.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[Hughhhhcoder]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-01T03:32:41.026981Z	d6c64eb	Manual request
🔒 Security Review	✅ Completed 2026-09-01T03:34:46.448521Z	d6c64eb	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Chef's kiss.

Reviewed commit: d6c64ebc53

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".