ci: add native Codex approval adapter for scoped changes

[czarcas7ic]

Motivation

Let eligible CI and deployment changes from authors with Write, Maintain, or Admin access satisfy the approval requirement through the existing native Codex review. Other PRs follow the repository's normal approval process.

Solution

Add a GitHub Actions adapter that checks author permissions, verifies a clean native review of the current commit, and submits approval through a dedicated App. Automatic reviews and ordinary @codex review requests remain supported after fixes; review commands count only from accounts with Write access or higher. Eligible Rust and Cargo.toml changes require their own changelog fragment; release helpers and release-policy waivers stay excluded. The App withdraws approvals when evidence stops qualifying, including after retargeting away from main, and can restore its own withdrawals while respecting human dismissals. The first approval starts a Slack thread in #gh-alerts; withdrawals and reapprovals reply there. Delivery receipts prevent repeated notifications, and uncertain Slack delivery requires operator reconciliation without changing the GitHub approval.

Setup uses repository Actions secrets and identity variables, with no environment, reviewer team, or rule changes. The adapter starts in read-only mode. Manual-result correlation depends on visible comments; deleted-request ambiguity is an accepted limitation for trusted authors. Withdrawal after changes is asynchronous and preserves the existing merge policy.

Testing

112 offline regression tests pass, covering native evidence, permissions, file eligibility, withdrawal recovery, and Slack approval cycles, retries, and failures. Actionlint, zizmor, Python lint, Markdown lint, and spelling checks pass. Earlier live read-only checks verified the author preflight and native evidence handling. Live App approval and Slack delivery still require activation validation. Used Codex for implementation, tests, and documentation.

[v12-auditor]

Warning

No auditable source files found in this PR's diff.

[chatgpt-codex-connector]

To use Codex here, create an environment for this repo.

[v12-auditor]

Warning

No auditable source files found in this PR's diff.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-09T00:39:41.563224Z	92e2dc9	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.