fix: explain scan sign-in refresh failures

[mldangelo-oai]

Summary

Make stored sign-in refresh failures actionable. Codex may need a valid
ChatGPT sign-in to load workspace-managed policies before making a model
request, even when the scan selects an environment API key. The CLI currently
does not recognize this failure and can give misleading credential advice.

Changes

• Give the Codex Security status/logout/login commands for final, permanent
  ChatGPT OAuth refresh failures without forwarding upstream error details.
• Suggest retrying first if the sign-in has already changed, and preserve
  native recovery advice for other credential states.
• Clarify the difference between model authentication and managed-policy
  loading in the authentication documentation.

Testing

• Complete CLI authentication test file: 27 passed, 0 failed.
• pnpm run test --seed 12345: 1,428 passed, 23 skipped, 0 failed.
• pnpm run test with seed 4204895570: 1,428 passed, 23 skipped, 0 failed.
• pnpm run types, pnpm run format, pnpm run build, and
  git diff --check: passed.
• Five native authentication checks using the pinned Codex executable,
  synthetic credentials, and a loopback server: passed. Valid managed
  configuration still loads before the API-key request; invalid managed
  requirements still stop the scan.
• Packed-package validation and installed-package smoke: passed, including
  the CLI, bundled Codex, and a nested worker.
• Three independent native code reviews and separate verification: clean.

Risk and rollout

This changes final CLI error presentation, not native authentication,
reconnect behavior, credential storage, or managed policy. A permanently expired
ChatGPT sign-in still requires an explicit logout/login. No dependency
update or credential migration is included. A package release is needed after
merge.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[mldangelo-oai]

@codex review

Please review commit b896475cda13b60eddb9ad8f1e6e11a23deb5389. Keep the public response limited to review results and public links.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Chef's kiss.

Reviewed commit: b896475cda

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".