Keep inline prompts out of the action helper argv

[original4422]

Summary

• add an environment-backed prompt source to the internal run-codex-exec helper
• pass only the fixed CODEX_PROMPT selector from the composite action instead of expanding the prompt into argv
• preserve the existing direct and file prompt interfaces and reject multiple sources

Testing

• node --test test/promptSource.test.mjs
• pnpm run check
• pnpm test (143 passed, 3 skipped)
• git diff --check

Closes #154