Add direct Codex Action vulnerability triage

[jeffreyolio]

What's in this PR?

Alternative A: adds an organization-owned reusable workflow that runs Barnacle dependency-vulnerability triage directly with openai/codex-action.

Codex receives read-only GitHub permissions, a narrow network allowlist, the shared triage skill, and a JSON output schema. It may prepare a workspace patch but cannot push or open a pull request. A separate job without the OpenAI key validates the result, applies any patch, opens a draft pull request, and uploads Barnacle's versioned result artifact.

This PR is mutually exclusive with the GitHub Agentic Workflow in #4; reviewers should choose one execution model.

Before

Repositories would need to duplicate the Codex prompt, permission profile, publication controls, and result contract.

After

Repositories call one small reusable workflow while Barnacle owns dispatch, Slack review, and lifecycle tracking.

QA Instructions

• Confirm Codex cannot write repository contents or pull requests and the publishing job does not receive the OpenAI key.
• After this workflow and one caller are merged, dispatch a synthetic no-change finding and confirm it produces barnacle-triage-<attempt_id> without opening a pull request.
• Dispatch a controlled remediation and confirm only the publishing job opens a draft pull request, reports its URL in the result artifact, and never merges it.

References

• Alternative B — GitHub Agentic Workflow: Add Agentic Workflow vulnerability triage #4
• Shared triage skill: https://github.com/GetJobber/jobber-skills/pull/193
• Barnacle integration: https://github.com/GetJobber/barnacle/pull/35
• Jobber caller: https://github.com/GetJobber/Jobber/pull/82075
• jobber-frontend caller: https://github.com/GetJobber/jobber-frontend/pull/14301
• Codex GitHub Action
• Codex Action security guidance