feat(ci): improve Codex code review workflow with incremental reviews

[tnunamak]

Enhance the Codex review workflow to support incremental reviews on every push while maintaining full PR reviews on open/reopen events.

Changes:

• Add synchronize and reopened triggers for continuous review
• Add concurrency control to cancel in-progress reviews on new pushes
• Pre-compute diffs and intelligently choose review scope based on event type
• Skip reviews if diff exceeds size limits (>100KB or >10k lines)
• Inject full diff into Codex prompt following OpenAI's recommended pattern
• Detect force pushes and flag them in the review context

Based on OpenAI's recommended patterns from the Codex SDK documentation.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Updated (UTC)
vana-console	Ready	Preview	Nov 19, 2025 0:19am
vana-rbac-auditor	Ready	Preview	Nov 19, 2025 0:19am
vana-vibes-demo	Ready	Preview	Nov 19, 2025 0:19am

[github-actions]

• Bug .github/workflows/codex-review.yml:46 – When we set BASE_SHA to ${{ github.event.before }} for incremental reviews, a force-push (github.event.forced == true) means that commit is no longer reachable in the fresh checkout. git diff "$BASE_SHA" "$HEAD_SHA" (and the subsequent log/name-status calls) will exit with fatal: bad object, causing the whole workflow to fail precisely on force pushes. Please fall back to a full PR diff (or otherwise guard the diff) when a force push is detected.

• High-impact .github/workflows/codex-review.yml:107 – The new “inject the diff” lines rely on $(cat /tmp/diff.txt) style command substitution, but GitHub Action inputs don’t evaluate shell syntax—only ${{ … }} expressions are expanded. As written, the Codex action receives the literal text “$(cat /tmp/diff.txt)” / “$(cat /tmp/commits.txt)”, so no diff or file list is ever provided and the feature doesn’t work. You’ll need to read those files in the step itself (e.g., capture them into ${{ }} outputs or use an action input that can read from a file) before passing them to the Codex prompt.