refactor(examples): port custom validation to TypeScript

[kmbroai]

Summary

Remove Python from the custom-validation demo. Compile the typed invoice app and HTTP validation script with the existing TypeScript compiler, then run the generated JavaScript on the supported Node.js runtime.

Stacked on #768.

Changes

• Replace app.py and validate.py with typed .mts sources; keep generated JavaScript untracked.
• Compile the demo into its temporary scan target and scan the TypeScript source.
• Preserve the synthetic invoice ownership flaw, authentication controls, proof JSON, and server cleanup.
• Update the validation prompts and documentation, add strict type/format coverage, and test the generated HTTP validator.

Testing

• Node 22.13.0 compilation and generated HTTP proof/cleanup test passed.
• Independent comparison matched the original Python proof JSON; failure-path checks confirmed server closure.
• SDK type and formatting checks passed.
• Full SDK suites with seeds 12345 and 1725112492: each had 2,138 passes, 41 skips, and zero failures.
• Independent code review and three final native review passes completed with no actionable findings; fresh verification passed.
• A live model-backed scan was not run.

Risk and rollout

The demo uses the existing SDK development dependencies to compile its fixture before running. It continues to use only synthetic data and an ephemeral loopback HTTP server. This PR has 247 added lines and removes two Python files.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-02T22:42:53.490111Z	a5674c4	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[mldangelo-oai]

The compiled example preserves the authentication controls and proof output, and the HTTP validation and server cleanup test passes locally. No actionable findings in the example migration.