安装 Codex Security 插件并配置 CI 扫描

安装 codex-security@openai-curated，通过 security-diff-scan 审查代码变更。CI 使用独立 CODEX_HOME，扫描密钥仅传入扫描进程。

npm install --global @openai/codex
codex plugin add codex-security@openai-curated
codex plugin list

# 会话里：/plugins 搜 Codex Security；0.154 起先看当前会话
# Use $codex-security:security-diff-scan to review my current uncommitted changes for security regressions.

# CI 示例（密钥只给这一步）：
# export CODEX_HOME="$RUNNER_TEMP/codex-home"
# export TMPDIR="$RUNNER_TEMP/codex-security"
# CODEX_API_KEY="$CODEX_SECURITY_API_KEY" codex exec --sandbox workspace-write "Use \$codex-security:security-diff-scan … Do not modify the checkout."

# 不要：
# plugin install codex-security@openai-curated
# plugin add security@openai-curated
# npx @openai/codex-security scan DIR
# gemini extensions install https://github.com/gemini-cli-extensions/security
# marketplace add openai/codex-security