fix: surface deduplication review failure reasons

[kmbroai]

Summary

Deduplication failures currently discard the underlying error. Include the reason in the existing CodexSecurityError message so callers can diagnose the failure.

Changes

• Surface Codex request and turn errors, validation failures, and missing submissions.
• Reuse safeErrorMessage to omit credential-bearing messages. Keep malformed JSON errors generic and omit stderr and response-detail fields.

Testing

• bun test --timeout 30000 tests-ts/codex-review.test.ts tests-ts/errors.test.ts: 17 passed, 3 platform-specific skips.
• pnpm run types: passed.
• pnpm run format: passed.
• git diff --check: passed.
• pnpm run test --seed 12345: attempted; stopped after broader failures, including sandbox temporary-directory ownership checks. Full-suite validation is incomplete.

Risk and rollout

Only error text changes. The error class, cancellation, validation, cleanup, and finding-write behavior are unchanged. No new flags, error categories, or dependencies.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-08-31T19:16:58.653030Z	9d34b26	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.