ci: add reusable OpenAI PR review workflow

[idy]

Summary

• add a reusable, configurable OpenAI PR-review workflow powered by openai/codex-action
• keep Codex read-only and publish/update its structured review result from a separate least-privilege job
• document the caller contract, explicit secret forwarding, model selection, fork skip, and rollout boundaries

Closes #1

Validation

• actionlint -color .github/workflows/codex-openai-review.yml
• JSON parse of the action output schema
• local Node smoke tests for both create-comment and update-comment publication paths
• git diff --check

Not run

• A live internal caller PR: it requires the organization-secret allowlist and an OpenAI API key, both intentionally outside this issue's scope.

[idy]

@codex

[github-actions]

OpenAI PR review

Model: gpt-5.6-terra

Summary

The new internal PR review workflow exposes the OpenAI API key to code defined by same-repository pull requests.

Findings

1. P1 .github/workflows/openai-pr-review.yml:15 — Do not run the PR-controlled workflow with the API key

`pull_request` runs the workflow definition from the PR’s merge ref, and this local reusable-workflow reference therefore executes a version of `codex-openai-review.yml` that the PR can modify. A contributor who can open a branch in this repository can change that file (or this wrapper) to send `OPENAI_API_KEY` elsewhere; the fork check does not protect against same-repository branches. Gate the secret behind an approving protected environment or use a trusted-base workflow/other review architecture before making it available to internal PR runs.

[idy]

Addressed the P1 in 974a9cc: the API-key-bearing review now runs only from a workflow_run dispatcher loaded from main. It resolves the PR through GitHub's API, checks out the trusted base SHA, and supplies the PR diff as data without checking out or executing the head or merge ref. The initial bootstrap requires this dispatcher to be merged before later PRs can self-review through it.

[idy]

@codex

[idy]

@codex review

[idy]

@codex review

[idy]

@codex review