fix: fail closed on unusable Codex auth during sandbox auth merge

When reusing a Codex sandbox, the workspace-restore step now performs
an auth-merge check before adopting the sandbox's auth.json. The merge
fails closed when:

- host or sandbox Codex auth is unusable (missing token or account)
- the subscription payload shapes differ between host and sandbox
- subscription account identities do not match

Additional hardening: node absence on PATH during the embedded decision
script now exits non-zero instead of silently falling through. Co-change
comments link parseAuth (the embedded script) to hasUsableAuthPayload
(codex-home.ts) so a future auth-format change cannot silently diverge
between the two implementations.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.github/scripts/tests/get-bot-token.test.mjs

@@ -0,0 +1,33 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { resolveInstallationId } from '../get-bot-token.mjs';
+
+test('resolveInstallationId: uses the repo installation endpoint when repo context is available', async () => {
+  const seenPaths = [];
+  const installationId = await resolveInstallationId(async (path) => {
+    seenPaths.push(path);
+    return { id: 42 };
+  }, 'jwt', 'paperclipai/paperclip', 'paperclipai');
+
+  assert.equal(installationId, 42);
+  assert.deepEqual(seenPaths, ['/repos/paperclipai/paperclip/installation']);
+});
+
+test('resolveInstallationId: falls back to the matching owner installation', async () => {
+  const installationId = await resolveInstallationId(async () => ([
+    { id: 1, account: { login: 'someone-else' } },
+    { id: 7, account: { login: 'PaperclipAI' } },
+  ]), 'jwt', undefined, 'paperclipai');
+
+  assert.equal(installationId, 7);
+});
+
+test('resolveInstallationId: rejects ambiguous installations without repo or owner context', async () => {
+  await assert.rejects(
+    resolveInstallationId(async () => ([
+      { id: 1, account: { login: 'org-one' } },
+      { id: 2, account: { login: 'org-two' } },
+    ]), 'jwt'),
+    /Multiple commitperclip installations found/
+  );
+});