fix: fail closed on unusable Codex auth during sandbox auth merge

When reusing a Codex sandbox, the workspace-restore step now performs
an auth-merge check before adopting the sandbox's auth.json. The merge
fails closed when:

- host or sandbox Codex auth is unusable (missing token or account)
- the subscription payload shapes differ between host and sandbox
- subscription account identities do not match

Additional hardening: node absence on PATH during the embedded decision
script now exits non-zero instead of silently falling through. Co-change
comments link parseAuth (the embedded script) to hasUsableAuthPayload
(codex-home.ts) so a future auth-format change cannot silently diverge
between the two implementations.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.github/scripts/tests/check-pr-lockfile.test.mjs

@@ -0,0 +1,33 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { checkLockfile } from '../check-pr-lockfile.mjs';
+
+const makeFiles = (filenames) => filenames.map(f => ({ filename: f, status: 'modified' }));
+
+test('passes when lockfile is not changed', () => {
+  assert.equal(checkLockfile(makeFiles(['src/foo.ts']), 'someuser', 'fix/bug').passed, true);
+});
+
+test('passes when lockfile changed by refresh bot on correct branch', () => {
+  const result = checkLockfile(
+    makeFiles(['pnpm-lock.yaml']),
+    'github-actions[bot]',
+    'chore/refresh-lockfile'
+  );
+  assert.equal(result.passed, true);
+});
+
+test('fails when lockfile changed by regular user', () => {
+  const result = checkLockfile(makeFiles(['pnpm-lock.yaml']), 'someuser', 'fix/bug');
+  assert.equal(result.passed, false);
+  assert.ok(result.failures[0].includes('pnpm-lock.yaml'));
+});
+
+test('fails when lockfile changed by bot on wrong branch', () => {
+  const result = checkLockfile(
+    makeFiles(['pnpm-lock.yaml']),
+    'github-actions[bot]',
+    'fix/something-else'
+  );
+  assert.equal(result.passed, false);
+});