ci: add codex-plugin-scanner workflow

[internet-dot]

I opened this to add a scanner-only check for the Codex plugin surface in the repo.

A couple of repo-specific details I checked first:

• Stop relying on outdated training data or risky web searches. Learn MCP server provides secure, direct access to Microsoft official docs
• The Microsoft Learn MCP Server offers experimental features that are under active development. These features may change or be refined based on user feedback and usage patterns
• This endpoint supports OpenAI Deep Research models and follows the OpenAI MCP specification

The current local scan came back 85/100 (grade B).

This PR only adds the scanner workflow. It does not touch runtime code or release behavior.
If you would rather wire it in a different workflow file, I can adjust the branch.