Harden automatic Baseline repair isolation

[ranade-oss]

What changed

• Runs Codex with the official read-only permission profile.
• Makes the Codex action the final step of its runner job, as recommended by OpenAI.
• Returns a schema-constrained unified patch instead of relying on a Codex-mutated workspace.
• Applies the untrusted patch only in a fresh write-capable runner after exact-head verification.
• Rejects oversized, binary, deleted, renamed, mode-changing, executable, symlink, submodule, protected-path, and out-of-scope changes.
• Keeps the two-attempt limit and final Baseline merge gate.

Human-input impact

None for ordinary safe repairs. Protected or unrepairable failures still stop for human review.

Key setup

Do not add OPENAI_API_KEY until this hardening PR is merged. After merge, use a dedicated OpenAI project/service-account key stored only as the repository Actions secret OPENAI_API_KEY, with a constrained project budget and the narrowest available API permissions.