Security: Harden codex-review workflow against script injection

[abhayclasher]

Summary

This PR improves the security posture of the codex-review workflow by moving untrusted Pull Request metadata (title and body) into environment variables.

Why this is necessary

Directly interpolating ${{ github.event.pull_request.title }} and ${{ github.event.pull_request.body }} into a workflow step is a security risk, especially in pull_request_target workflows. This can lead to command injection if the underlying action or any shell scripts process these inputs. By using the env context, we ensure the data is handled as a literal string, preventing arbitrary code execution within the runner context.

Changes

• Refactored the run_codex step to use the env context for PR_TITLE and PR_BODY.
• Updated the prompt argument to reference these environment variables.

[rolandwalker]

Thanks, @abhayclasher !