fix: stop retrying sealed incomplete bulk scans

[kmbroai]

Summary

Treat sealed bulk-scan results with partial or unknown coverage as the distinct terminal completed_with_incomplete_coverage outcome instead of retrying a completed scan and multiplying its cost.

Preserve the existing artifacts, scan directory, coverage, cost, explicit warning, and durable receipt. Keep incomplete scans fail-closed with exit code 2, including resumed campaigns, while retaining retries for operational failures and missing artifacts.

Test Plan

• Full package suite: 913 passed, 10 expected platform/integration skips, 0 failed.
• Focused multiscan/CLI suites: 142 passed, 0 failed.
• pnpm run types, pnpm run format, and pnpm run build: passed.
• Packed and validated the installable npm tarball: public import and CLI passed; 106 bundled plugin files and 198 package entries verified.

[kmbroai]

@ianw-oai GitHub automatically dismissed your approval when I merged current main after #287 landed. The only manual conflict resolution preserves both multiscan test imports; both fixes are intact. Full public validation: 952 tests passed, 10 expected skips, zero failures; typecheck, formatting, package contract, and installed-package nested-worker smoke all passed. Could you please re-approve?