fix(ci): restore Codex Security scan execution

[alangou]

Summary

Codex Security release qualification never produced a report. The scan agent
could not execute a single shell command on GitHub-hosted runners, so it sealed
no draft and every run failed with a missing or incomplete draft. This restores
a completing scan and adds the diagnostics that made the cause visible.

Related Issue

Part of #2989.

Changes

• Clear kernel.apparmor_restrict_unprivileged_userns before installing the
  scanner. Codex confines model-run commands with bubblewrap, which needs
  unprivileged user namespaces. Ubuntu 24.04 restricts those through AppArmor,
  so bubblewrap failed to configure the sandbox network namespace
  (bwrap: loopback: Failed RTM_NEWADDR) and the agent executed nothing.
• Set approval_policy="never" for the scan. Codex Security pins
  approvals_reviewer="auto_review" unconditionally, and that reviewer runs on
  gpt-5.6-luna, which the configured NVIDIA endpoint does not serve, so every
  approval request went to an unreachable model.
• Keep the analyze job on ubuntu-latest. The agent executes no shell
  commands at all on the repository self-hosted runner, so its preflight never
  scopes the diff.
• Publish a derived diagnostic summary when a scan fails: runner capacity,
  result files written, the runtime negotiated per turn, agent item types,
  plugin tool outcomes, and shell command outcomes. A scan that stops before
  sealing its draft otherwise looks identical whatever the cause.
• Probe the Codex sandbox in the diagnostic job without consuming inference,
  and report the two kernel switches bubblewrap depends on.
• Report non-sensitive runner context as counts only. The previous step
  published the resolved addresses of the inference endpoint, which are
  internal on a self-hosted runner, into public workflow logs.
• Show the Codex event stream when the diagnostic fails instead of deleting it.
• Add an upload_sarif input so manual dispatches do not overwrite a release
  train's published analysis.
• Cap the multi-agent runtime at four concurrent threads.

Testing

• mise run pre-commit passes
• Actionlint reports no findings for .github/workflows/codex-security.yml
• Zizmor reports no High findings, and no new findings versus the base
• mise run markdown:lint passes
• Full qualification run completes: 95/95 files reviewed, findings
  validated, attack paths analyzed, report written, SARIF exported
  (run 33636911133, 16m20s)
• Sandbox probe reproduces the root cause on a GitHub-hosted runner:
  AppArmor userns restriction: 1 and bwrap: loopback: Failed RTM_NEWADDR
• Diagnostic event stream confirms the agent retried its shell tool and
  gave up, on both GitHub-hosted and self-hosted runners
• Verified against the NVIDIA endpoint that openai/gpt-5.6-sol and
  gpt-5.6-sol return 403 key not allowed to access model, so the
  slash-qualified identifier cannot be shortened to let Codex resolve model
  metadata
• Unit tests added/updated (not applicable to this CI-only change)
• E2E tests added/updated (not applicable to this CI-only change)

Known gaps, not addressed here:

• The four-thread cap is unverified. On a local reproduction it reduced the scan
  from six surfaces and one medium finding to four surfaces and none, while both
  runs still reported complete coverage.
• Codex still falls back to default model metadata, because the endpoint
  requires openai/openai/gpt-5.6-sol while Codex strips only one prefix
  segment. This is also why --max-cost does not apply.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated