fix(codex-review): let maintainer-authorized fork PRs re-review on push

[jeff-r2026]

What

Fixes the fork-PR auto re-review added in #631, which never actually worked.

The bug

#631 lets a maintainer "assign once" and then have later pushes re-review automatically. Our gate job correctly authorizes a re-review when the PR carries a maintainer as an assignee. But openai/codex-action then runs its OWN write-access check against the triggering actor — and on a fork PR's synchronize event, the actor is the PR author (read access). So every fork auto re-review failed at the Codex step:

Checking write access for actor 'SaulMoro' on Tencent/teamai-cli
Actor 'SaulMoro' is not permitted to run this action ... Detected permission: 'read'.

Observed on real runs: PR #625 (author SaulMoro push) and PR #614 (author jiajia919 push) — gate said authorized, codex-action then rejected the author.

The fix

Pass allow-users: "*" to codex-action, disabling its actor check.

This does not widen who can trigger a review. Our gate job is the real, stricter authorization door — an un-authorized PR gets authorized=false and the review job never runs (if: needs.gate.outputs.authorized == 'true'). codex-action's check is redundant with the gate, and simply wrong for the fork-push case (it looks at the author, not at who authorized the PR).

Security — no key exposure

All secret-protecting layers are unchanged; the removed check was never one of them:

• Authorization — our gate still requires a maintainer (write/admin/maintain) to have authorized the PR; unauthorized PRs never reach the Codex step.
• No code execution — checkout is the trusted base commit (never PR head); PR changes are read only as a git diff; nothing is built, npm install-ed, or run.
• Rules from base — pull_request_target uses the base branch's workflow and the base AGENTS.md; a PR can't rewrite its own criteria.
• Token off disk — persist-credentials: false.
• Read-only Codex — permission-profile: :read-only.
• The API key lives in the responses-api-proxy process env (to reach the gateway), not in Codex's readable context; Codex can't emit it, and can only produce a PR comment.

Test plan

• actionlint (rhysd/actionlint docker) — PASS (only the known stale-metadata false positives for permission-profile / allow-users, both verified present on the authoritative @v1 action.yml).
• allow-users confirmed a valid @v1 input.

Note: as with #622/#631, pull_request_target runs the base-branch definition, so the fork re-review path can only be exercised after merge. Recommended post-merge check: assign an open fork PR (e.g. #625 or #614), then have the author push (or push to the fork branch) and confirm a second Codex review appears without re-assigning — and that the run no longer fails on the actor write-access check.