[P1] **Codex Security:** scan cumulative diffs nightly and periodically run a full scan. Convert validated findings into deduplicated private draft GitHub Security Advisories. Keep raw output ephemeral; PSIRT controls confirmation, remediation, CVE requests, and publication. #2989