Expose trustworthy raw JSONL telemetry from Codex Exec Action

[ramykh81]

Please provide a reviewed, immutable, pinned action revision that exposes trustworthy raw codex exec --json JSONL from the same child process and invocation.

The output must include exactly one terminal turn.completed usage record containing:

• input tokens
• cached-input tokens
• output tokens
• reasoning-output tokens

Please preserve:

• secret isolation and no credential leakage;
• existing privilege separation and sandbox protections;
• exactly one Codex invocation;
• zero retries;
• separate raw JSONL, stderr, and final-message handling;
• deterministic failure when telemetry is unavailable;
• no second CLI invocation, shell tee workaround, unpinned shim, fabricated telemetry, or weakened security boundary.

The downstream consumer must fail closed on malformed, missing, duplicate, negative, or incomplete usage records. Over-threshold observed API-equivalent cost must be reported as USAGE_ANOMALY, not a billing cap.

Required evidence:

• immutable action commit SHA;
• reviewed source diff;
• proof telemetry comes from the same child process and invocation;
• proof stdout JSONL is isolated from stderr and logs;
• proof secrets cannot enter the telemetry artifact;
• documented output schema and lifecycle;
• fixture tests for valid and invalid usage;
• proof exactly one terminal turn.completed record is enforced;
• proof no retry, second invocation, unpinned dependency, or privilege weakening is required;
• example workflow using the pinned revision without exposing credentials.