CI: contract + canary + live e2e suites (channels, voice)

[dimavrem22]

Ports the proven plugin-fleet CI architecture (hermes-agent-plugin, openclaw-plugin) to the Codex bridge. External-events suite deliberately excluded, as in openclaw-plugin.

The three tiers

1. tests.yml — offline unit matrix (Python 3.10/3.12, replaces ci.yml) on every push/PR, plus a per-PR contract gate against the real Codex host.
2. canary.yml — the same contract suite on a 2×/day schedule (06:13 / 18:13 PT — one hour before the openclaw-plugin canary, two before hermes, so host breakage pages in waves, not all at once). Google Chat alert on scheduled failures only. live-channels chains off a passing canary via workflow_run.
3. live-channels.yml / live-voice.yml — boot the real bridge (inkbox-codex run) driving a real codex app-server on the AUT identity (CODEX_INKBOX_* secrets); the shared driver identity (REMOTE_INKBOX_*) emails/texts/calls it and asserts delivery + content + transcripts. Mock-model leg (deterministic, free) + real gpt-5.5 leg; voice runs inbound_inkbox and outbound_realtime scenarios. Ready-PR/dispatch/canary-chain gating, the repo-wide inkbox-live-aut-tunnel concurrency lock, and failure-only log dumps (public repo) all match the fleet pattern.

"Freshest Codex main each time"

Codex is a Rust host — building main from source per run would cost 15–30 min of compile. OpenAI cuts the @openai/codex@alpha npm prerelease from main near-daily (today's alpha.33 was published ~2 h before this PR), so every contract/canary/live run installs that: a prebuilt binary of main within ~24 h, per run, no compile.

Codex-specific findings baked in

• wire_api = "chat" was removed from Codex main (Deprecating `chat/completions` support in Codex openai/codex#7782): custom providers must speak the Responses API. The mock model server (tests/live/mock_openai.py) therefore implements POST /v1/responses (SSE streaming + non-streaming) alongside chat completions.
• No account auth needed for the mock leg: the app-server handshake, thread/start, and turns on a custom provider all run unauthenticated — verified locally against alpha.33. The real leg authenticates with printenv OPENAI_API_KEY | codex login --with-api-key.
• Contract suite is turn-deep: beyond raw-protocol probes (initialize, thread/start/resume, turn/interrupt, account/rateLimits/read, account/usage/read), it drives a full mock turn + cross-process thread resume through the bridge's own CodexAppServerClient — the exact notification stream (item/agentMessage/delta, item/completed, turn/completed) the gateway depends on, at zero token cost. 5/5 green locally vs alpha.33.
• Unattended-runner policy: live legs set CODEX_APPROVAL_POLICY=never + CODEX_SANDBOX=read-only — nobody is on the other end to answer an approval text, and a stray command stays harmless.
• thread/resume requires a persisted rollout, so a fresh no-turn thread can't resume — the contract asserts the method routes, and proves real resume turn-first (matching how the bridge actually resumes from sessions.json).

Live suite deltas from the fleet

• Env key is CODEX_INKBOX_API_KEY; error-marker for a failed turn is the bridge's canned "hit an error" reply.
• Tool names are scraped from inkbox_codex/tools.py string literals (no manifest here).
• The contact-CRUD opt-in test does create + update through the agent and cleans up via the SDK — this bridge exposes no contact-delete tool.