ci: add native Codex approval adapter for scoped changes - #922

Motivation

Let eligible CI and deployment changes from authors with Write, Maintain, or Admin access satisfy the approval requirement through the existing native Codex review. Other PRs follow the repository's normal approval process.

Solution

Add a GitHub Actions adapter that checks author permissions, verifies a clean native review of the current commit, and submits approval through a dedicated App. Automatic reviews and ordinary @codex review requests remain supported after fixes; review commands count only from accounts with Write access or higher. Eligible Rust and Cargo.toml changes require their own changelog fragment; release helpers and release-policy waivers stay excluded. The App withdraws approvals when evidence stops qualifying, including after retargeting away from main, and can restore its own withdrawals while respecting human dismissals. The first approval starts a Slack thread in #gh-alerts; withdrawals and reapprovals reply there. Delivery receipts prevent repeated notifications, and uncertain Slack delivery requires operator reconciliation without changing the GitHub approval.

Setup uses repository Actions secrets and identity variables, with no environment, reviewer team, or rule changes. The adapter starts in read-only mode. Manual-result correlation depends on visible comments; deleted-request ambiguity is an accepted limitation for trusted authors. Withdrawal after changes is asynchronous and preserves the existing merge policy.

Testing

112 offline regression tests pass, covering native evidence, permissions, file eligibility, withdrawal recovery, and Slack approval cycles, retries, and failures. Actionlint, zizmor, Python lint, Markdown lint, and spelling checks pass. Earlier live read-only checks verified the author preflight and native evidence handling. Live App approval and Slack delivery still require activation validation. Used Codex for implementation, tests, and documentation.