feat: require hosted Codex review before merge

[davidahmann]

Problem

Mill could accept a draft PR after local review without requiring GitHub Codex to finish reviewing the exact latest head. Installation and first-use guidance also carried more detail than a newcomer needed.

Change

• add an opt-in github_codex_required review policy with the real GitHub Codex bot identity
• split draft readiness from final merge approval and bind post-readiness completion, feedback, exact head, and provider revision evidence
• re-read provider feedback around completion and reject malformed, ambiguous, stale, or changing summaries
• recheck hosted review evidence during final merge and post-merge closure
• keep P2/P3 advisory under the repository's p0_p1 policy
• shorten the README around install, inspect, approve, and reviewed draft delivery
• document the review policy, repository settings, architecture, approvals, and 0.9.0 release
• simplify local installation to an exact dev dependency plus npx --no-install millctl

Validation

• npm run check
• node dist/cli.js --json --cwd . audit
• exact-candidate local maintainer review: ready, no P0/P1 findings
• 54 test files and 569 tests pass
• packed 0.9.0 package canaries pass

[davidahmann]

@codex review