fix(ci): bump Codex CLI to 0.150.1 to unhang security review jobs (#6962)

Codex CLI 0.149.x can leave a PTY descendant holding
`openai/codex-action`'s inherited stdio after the review turn completes.
The action's runner waits on the child's stdio *streams closing* rather
than on process exit
([`runCodexExec.ts`](https://github.com/openai/codex-action/blob/86365089/src/runCodexExec.ts#L322)),
so the `Review pull request` step never returns — the job idles until
its 30-minute `timeout-minutes` kills it and the already-written review
result is discarded.

Every `Run Codex Security Review` job since the workflow merged has hung
this way: the final JSON result and `tokens used` count are the last log
lines, with no step-end marker. Heavy runs (`gpt-5.6-sol` at `max`
effort, ~295k tokens) sit firmly in the failing regime.

Upstream:
[openai/codex-action#150](https://github.com/openai/codex-action/issues/150),
fixed in Codex CLI 0.150.0 by
[openai/codex@bf3eb2e](bf3eb2ec91)
("Prevent Unix PTY I/O from blocking runtime shutdown"). The fix commit
is in the `rust-v0.150.x` line and not in `0.149.x`.

The action pin (`v1.12`) is unchanged — only the `codex-version` CLI pin
moves from `0.149.0` to `0.150.1` (latest stable).

Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
Co-authored-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>

.github/workflows/codex-security-review.yml

@@ -298,7 +298,7 @@ jobs:
           ACTIONS_ID_TOKEN_REQUEST_URL: ''
         with:
           openai-api-key: ${{ secrets.CODEX_REVIEW_API_KEY }}
-          codex-version: '0.149.0'
+          codex-version: '0.150.1'
           model: ${{ env.CODEX_MODEL }}
           codex-args: '["-c","model_reasoning_effort=${{ env.CODEX_REASONING_EFFORT }}"]'
           # The trusted authorization job already enforced repository membership.