fix: report resolved Codex CLI version

[pollychen-lab]

What this does

Fixes #171 by resolving the exact installed @openai/codex version once per run, surfacing it, and reusing it for the proxy install.

Why

When codex-version is left empty, the action currently installs whatever npm latest points to at run time. That means a workflow pinned to a specific action SHA can still execute a different Codex CLI on two runs of the same workflow.

This change makes that concrete and auditable:

• adds a codex-version action output with the exact installed version
• logs the resolved version during the install step
• writes the resolved version into the GitHub step summary
• documents that an empty input resolves latest at run time and should be pinned for reproducibility
• reuses the exact resolved version when installing @openai/codex-responses-api-proxy

Validation

• pnpm install --frozen-lockfile
• pnpm test
• git diff --check

[sylvesterkaczmarek]

The new exact-version handoff breaks supported range/tag inputs when the CLI and proxy publish sets differ. For example, >=0.58.0-alpha.9 <0.58.0-alpha.11 can resolve @openai/codex to 0.58.0-alpha.10, but that proxy version was never published (the proxy only has 0.58.0-alpha.9 in that range). Before this change each package resolved the input range independently; now the proxy install becomes @...proxy@0.58.0-alpha.10 and fails. Could the action report the exact CLI version without forcing the proxy to share it, or resolve/validate a compatible proxy version separately?

[pollychen-lab]

The new exact-version handoff breaks supported range/tag inputs when the CLI and proxy publish sets differ. For example, >=0.58.0-alpha.9 <0.58.0-alpha.11 can resolve @openai/codex to 0.58.0-alpha.10, but that proxy version was never published (the proxy only has 0.58.0-alpha.9 in that range). Before this change each package resolved the input range independently; now the proxy install becomes @...proxy@0.58.0-alpha.10 and fails. Could the action report the exact CLI version without forcing the proxy to share it, or resolve/validate a compatible proxy version separately?

Hi @sylvesterkaczmarek thanks for catching that. I updated the PR so the action still reports the exact resolved @openai/codex CLI version, but the proxy install now uses the original codex-version input instead of the resolved CLI version.

[sylvesterkaczmarek]

Re-reviewed the version handoff. The action now reports the exact installed CLI version as an output while the Responses proxy continues to resolve from the original codex-version input, so ranges/tags no longer require the CLI and proxy packages to have identical published version sets. The regression also pins that separation. My previous concern is resolved.