fix: recover Codex review with the v1.11 action pin

[dexsword]

Codex action v1.12 can leave Linux reviews hanging after Codex has produced its completed result. Roll back only the action pin to the verified v1.11 commit 52fe01ec70a42f454c9d2ebd47598f9fd6893d56.

Upstream: openai/codex-action#150 and openai/codex-action#151. This uses the released v1.11 commit, not the unmerged repair PR. CLI 0.153.4, the 20-minute timeout, reasoning effort, read-only/drop-sudo configuration, permissions, triggers and all review/auto-merge controls are unchanged. Exactly one workflow line changes.

Validation: clean npm ci; all 56 Node tests on current main; 9 deployment-control tests; CI smoke and synthetic health; actionlint; ShellCheck; YAML, JSON Schema, TOML and JavaScript/Python/shell syntax checks; production audit. All passed. Audit: zero high/critical, one existing low and one moderate advisory.

Bootstrap: pull_request_target uses main, so this PR's automatic review still loads the broken v1.12 pin. That review must not be treated as a successful check or repeatedly retried. Ordinary CI must pass and a human must review this one-line rollback before an authorized break-glass merge. The live Protect main ruleset is enforcing all required checks and currently has no bypass actors; no break-glass procedure was found in the repository docs. No ruleset, setting, secret or production change is part of this PR.

After the human-approved recovery reaches main, synchronize PR #17 with that main (its strict base/ancestry guards require this), update its pin documentation, and run its base-controlled review using v1.11. Verify the action's end marker, downstream jobs starting automatically, and no manual cancellation. Then validate with a small meaningful PR. Preserve all required checks and remove any temporary authorized exception after recovery.

This PR has not been merged. A human merge to main will trigger the existing production deployment workflow; plan that separately. PR #17's SHA placement, stale-run and duplicate-check fixes remain separate.

[dexsword]

Ordinary CI passed: https://github.com/dexsword/dextech/actions/runs/34144428441 on head ddb35515976ceb357c3a7457d2244e458eef9c31. The automatically started base-controlled v1.12 review was cancelled. This is intentionally still a human-reviewed break-glass recovery, not a successful Codex authorization. No settings, secrets, merges or deployments have been performed.