fix(ci): salvage Codex review output on PTY-shutdown hang

[wpfleger96]

Codex CLI can leave a PTY descendant holding the action's inherited stdio after the turn completes. The runCodexExec.ts wrapper waits on a close event that never fires, so the Review pull request step hangs until the job timeout kills it — discarding the finished review the CLI already wrote to disk.

The CLI writes the completed review to the --output-last-message file (exposed as output-file) before the hang. This PR adds a salvage step that recovers it, and sets the step and job timeouts to preserve the full 30-minute Codex execution budget.

Changes (codex-security-review.yml):

• Add output-file: ${{ runner.temp }}/codex-review.json to the Review pull request step so the CLI writes the result before the hang. (runner context is valid in steps.with; not in jobs.env.)
• Add timeout-minutes: 30 and continue-on-error: true to the Codex step — a hang now costs ≤30 minutes instead of 40, and the salvage step still runs.
• Set job timeout-minutes: 40 to give setup, step cancellation, and salvage sufficient headroom without colliding with the Codex execution budget. The original 30-minute job timeout was too narrow: evidence from run 33114428326 shows completed output appearing 28m46s after step start, meaning a 20-minute step timeout could kill a legitimate review before the salvage file exists.
• Add a Salvage review output step with if: always(): prefers steps.run_codex.outputs.final-message on a clean exit; falls back to the output file when the step timed out. The output file path is set in the step's own env block (CODEX_OUTPUT_FILE: ${{ runner.temp }}/codex-review.json), where runner is valid. Validates shape (non-empty JSON object, has overall_risk); fails the job hard if neither source is present.
• Wire the job outputs.review_json to steps.salvage.outputs.review_json.

Changes (Justfile, ci.yml):

• Add actionlint .github/workflows/codex-security-review.yml to security-review-check so expression-validity errors are caught locally.
• Provision actionlint via Hermit (pinned v1.7.12) rather than a one-off Install actionlint curl step, so the same binary is used locally and in CI.

Security posture is unchanged: the salvage step reads the action's own output and a file written to runner.temp — neither is PR-controlled. Credential-stripping env block on the Codex step is untouched.

Note this is a temporary workaround until openai/codex-action#169 is addressed