fix: validate knowledge-base inputs during dry-run scans

[kmbroai]

Summary

• Validate knowledge-base inputs during SDK preflight so codex-security scan --dry-run rejects the same invalid documents as an actual scan.
• Reuse existing document parsing and clean up temporary staging immediately without initializing the Codex runtime.
• Add regression coverage for valid Markdown, missing files, unsupported formats, malformed PDFs, empty directories, and symlinks.

Validation

• Full SDK test suite: 908 passed, 10 expected platform/integration skips.
• TypeScript typecheck, generated-model verification, and formatting checks.
• Built the CLI and executed all five invalid knowledge-base cases plus a valid Markdown case.
• Packed and installed the npm artifact; package validation passed with 198 archive entries and all 106 bundled plugin files.