docs: correct runtime and scan guidance

[mldangelo-oai]

Summary

Keep the TypeScript README aligned with the current CLI and SDK.

• Explain which commands require Python and how --python, pythonPath, and PYTHON select the interpreter.
• Correct credential-store and deep-scan defaults, including user configuration and command-line overrides.
• Document nested Git repositories, clean submodules, bulk-scan concurrency and retries, and workbench database locations.
• Check documented defaults against the runtime configuration.

Preserves @GautamSharma99's original contribution from #124.

Verification

• pnpm run format
• pnpm run types
• pnpm run build
• pnpm run test: 1,037 passed; 11 expected platform and integration skips.

[mldangelo-oai]

@codex review

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: 23cf480161

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 23cf480161

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Test behavior instead of exact README text

Replace the newly added literal .toContain checks—including the analogous deep-scan assertion below—with a semantic check or a source-level configuration test. These assertions couple the suite to the README’s exact TOML spelling and formatting, so harmless documentation edits can fail package checks even when the documented value remains correct; the scoped testing guidance explicitly says to avoid tests of exact Markdown wording.

AGENTS.md reference: sdk/typescript/AGENTS.md:L29-L32

Useful? React with 👍 / 👎.