fix(picklescan): preserve fail-closed legacy global scans

[mldangelo-oai]

Summary

• Fix the Windows/Python 3.11 failure in scheduled Nightly CI run 32214858406, where copy_reg._reconstructor legitimately failed closed during shared-source instability but its regression test required COMPLETE.
• Exercise stable and changed source snapshots deterministically for all three legacy Python 2 aliases, including the previously uncovered copy_reg._reconstructor and exceptions.WindowsError cases.
• Preserve strict COMPLETE/CLEAN results for stable snapshots and require INCONCLUSIVE/UNKNOWN, incomplete-analysis metadata, the exact source-stability diagnostic, and clean import-reference checks for changed snapshots.

Validation

• Before the fix: both changed-source copy_reg._reconstructor and exceptions.WindowsError regressions failed; the existing exceptions.ValueError case passed.
• Standalone API suite on Python 3.11: 1,080 passed, 44 skipped.
• Adjacent pickle, Joblib, source-stability, and Nightly checks: 91 passed.
• Focused legacy/source-stability checks: 14 passed.
• Repository-wide Ruff lint and formatting checks passed; changed-file mypy passed.
• Full-repository mypy reproduces the same 14 existing errors in six untouched files already present on main.

The existing vulnerable-dependency audit failure on main is already addressed by #1808 and is intentionally outside this fix.

[mldangelo-oai]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Hooray!

Reviewed commit: 647c1a6b3b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: 647c1a6b3b

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[github-actions]

Workflow run and artifacts

Performance Benchmarks

Compared 13 shared benchmarks with a regression threshold of 15%.
Status: 1 regressions, 0 improved, 12 stable, 0 new, 0 missing.
Aggregate shared-benchmark median: 2.797s -> 2.923s (+4.5%).

Top regressions:

• tests/benchmarks/test_scan_benchmarks.py::test_scan_warm_cached_repository_rescan +138.2% (92.98ms -> 221.48ms, warm-cache-rescan, release-candidate, size=547.3 KiB, files=32)

Workload	Benchmark	Target	Size	Files	Baseline	Current	Change	Status
warm-cache-rescan	tests/benchmarks/test_scan_benchmarks.py::test_scan_warm_cached_repository_rescan	release-candidate	547.3 KiB	32	92.98ms	221.48ms	+138.2%	regression
direct-malicious-upload	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_direct_malicious_upload	malicious_reduce	52 B	1	134.2us	142.0us	+5.8%	stable
nested-payload-review	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_nested_payload_review[nested_base64]	nested_base64	98 B	1	186.1us	179.4us	-3.6%	stable
padded-multi-stream-upload	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_padded_multi_stream_upload	multi_stream_padded	4.1 KiB	1	201.3us	208.2us	+3.4%	stable
single-checkpoint-preflight	tests/benchmarks/test_scan_benchmarks.py::test_scan_single_checkpoint_before_load	single_checkpoint.pkl	183.0 KiB	1	71.15ms	69.61ms	-2.2%	stable
suspicious-pickle-intake	tests/benchmarks/test_scan_benchmarks.py::test_scan_suspicious_pickle_intake	suspicious-intake	183.8 KiB	4	103.76ms	105.54ms	+1.7%	stable
nested-payload-review	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_nested_payload_review[nested_hex]	nested_hex	130 B	1	192.4us	195.0us	+1.3%	stable
mixed-model-repository	tests/benchmarks/test_scan_benchmarks.py::test_scan_release_candidate_repository	release-candidate	547.3 KiB	32	423.90ms	418.66ms	-1.2%	stable
nested-payload-review	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_nested_payload_review[nested_raw]	nested_raw	78 B	1	166.0us	168.0us	+1.2%	stable
chunked-upload-stream	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_chunked_upload_stream	chunked_stream	278.2 KiB	1	83.03ms	82.58ms	-0.5%	stable
duplicate-heavy-registry	tests/benchmarks/test_scan_benchmarks.py::test_scan_duplicate_registry_snapshot	registry-snapshot	915.2 KiB	13	402.02ms	403.30ms	+0.3%	stable
rejected-basic-auth-candidates	tests/benchmarks/test_scan_benchmarks.py::test_rejected_basic_auth_candidates_scan_linearly	-	371.1 KiB	1	1.538s	1.540s	+0.1%	stable
clean-training-checkpoint	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_clean_training_checkpoint	safe_large	278.2 KiB	1	81.22ms	81.13ms	-0.1%	stable