fix: fail closed on unusable Codex auth during sandbox auth merge

When reusing a Codex sandbox, the workspace-restore step now performs
an auth-merge check before adopting the sandbox's auth.json. The merge
fails closed when:

- host or sandbox Codex auth is unusable (missing token or account)
- the subscription payload shapes differ between host and sandbox
- subscription account identities do not match

Additional hardening: node absence on PATH during the embedded decision
script now exits non-zero instead of silently falling through. Co-change
comments link parseAuth (the embedded script) to hasUsableAuthPayload
(codex-home.ts) so a future auth-format change cannot silently diverge
between the two implementations.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.github/scripts/fetch-pr-files.mjs

@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+/**
+ * fetch-pr-files.mjs
+ * Fetches the full changed-file list for a PR across GitHub pagination.
+ */
+
+export async function fetchAllPullRequestFiles(ghFetchFn, repo, prNumber, token) {
+  const files = [];
+
+  for (let page = 1; ; page += 1) {
+    const batch = await ghFetchFn(
+      `/repos/${repo}/pulls/${prNumber}/files?per_page=100&page=${page}`,
+      token
+    );
+    files.push(...batch);
+
+    if (batch.length < 100) {
+      return files;
+    }
+  }
+}