fix: fail closed on unusable Codex auth during sandbox auth merge

When reusing a Codex sandbox, the workspace-restore step now performs
an auth-merge check before adopting the sandbox's auth.json. The merge
fails closed when:

- host or sandbox Codex auth is unusable (missing token or account)
- the subscription payload shapes differ between host and sandbox
- subscription account identities do not match

Additional hardening: node absence on PATH during the embedded decision
script now exits non-zero instead of silently falling through. Co-change
comments link parseAuth (the embedded script) to hasUsableAuthPayload
(codex-home.ts) so a future auth-format change cannot silently diverge
between the two implementations.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.github/scripts/check-pr-dependencies.mjs

@@ -0,0 +1,89 @@
+#!/usr/bin/env node
+/**
+ * check-pr-dependencies.mjs
+ * Detects new npm packages added in this PR vs. the base branch.
+ * Never fails (informational only) — outputs { passed: true, informational: string[] }
+ */
+import { fileURLToPath } from 'node:url';
+import { ghFetch } from './get-bot-token.mjs';
+
+function buildContentsPath(repo, filename, ref) {
+  return `/repos/${repo}/contents/${filename}?${new URLSearchParams({ ref }).toString()}`;
+}
+
+export async function resolveBaseRef(fetchFromGitHub, token, repo, prNumber, baseRef) {
+  if (baseRef) {
+    return baseRef;
+  }
+
+  const pr = await fetchFromGitHub(`/repos/${repo}/pulls/${prNumber}`, token);
+  if (pr.base?.ref) {
+    return pr.base.ref;
+  }
+
+  const repository = await fetchFromGitHub(`/repos/${repo}`, token);
+  if (repository.default_branch) {
+    return repository.default_branch;
+  }
+
+  throw new Error(`Unable to resolve a base branch for ${repo}#${prNumber}.`);
+}
+
+export async function checkDependencies(files, token, repo, prNumber, baseRef, fetchFromGitHub = ghFetch) {
+  const pkgFiles = files.filter(
+    f => f.filename.endsWith('package.json') &&
+         !f.filename.includes('node_modules') &&
+         f.status !== 'removed'
+  );
+
+  if (pkgFiles.length === 0) return { passed: true, informational: [] };
+
+  const resolvedBaseRef = await resolveBaseRef(fetchFromGitHub, token, repo, prNumber, baseRef);
+  const newPackages = new Set();
+
+  for (const file of pkgFiles) {
+    try {
+      const [baseRes, prRes] = await Promise.all([
+        fetchFromGitHub(buildContentsPath(repo, file.filename, resolvedBaseRef), token),
+        fetchFromGitHub(buildContentsPath(repo, file.filename, `refs/pull/${prNumber}/head`), token),
+      ]);
+
+      const basePkg = JSON.parse(Buffer.from(baseRes.content, 'base64').toString());
+      const prPkg = JSON.parse(Buffer.from(prRes.content, 'base64').toString());
+
+      const baseDeps = new Set([
+        ...Object.keys(basePkg.dependencies ?? {}),
+        ...Object.keys(basePkg.devDependencies ?? {}),
+        ...Object.keys(basePkg.peerDependencies ?? {}),
+      ]);
+
+      for (const dep of [
+        ...Object.keys(prPkg.dependencies ?? {}),
+        ...Object.keys(prPkg.devDependencies ?? {}),
+        ...Object.keys(prPkg.peerDependencies ?? {}),
+      ]) {
+        if (!baseDeps.has(dep)) newPackages.add(dep);
+      }
+    } catch {
+      // File may not exist on base — skip
+    }
+  }
+
+  if (newPackages.size === 0) return { passed: true, informational: [] };
+
+  const pkgList = [...newPackages].map(p => `\`${p}\``).join(', ');
+  return {
+    passed: true,
+    informational: [
+      `📦 New dependencies added: ${pkgList}. Review may take longer and new dependencies ` +
+      `are less likely to be accepted — please check if existing deps cover this need.`,
+    ],
+  };
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+  const { GH_TOKEN, GH_REPO, PR_NUMBER, PR_FILES, PR_BASE_REF } = process.env;
+  const files = JSON.parse(PR_FILES ?? '[]');
+  const result = await checkDependencies(files, GH_TOKEN, GH_REPO, PR_NUMBER, PR_BASE_REF);
+  console.log(JSON.stringify(result));
+}