Upgrade Codex review workflows and repository validation

[TheSilkky]

Summary

• migrate the Phase 0, Phase 1, and Phase 2 technical-review workflow from the former deep-research prompts to Codex maximum-reasoning prompts
• apply the approved full-repository validation and documentation reconciliation across simulator, rate-limit, wrapped-key, relay, optional-backend, and operational guidance
• publish the disclosure-hardened unreleased technical-review report
• separate tracked repository tooling under scripts/ from ignored local/generated helpers under .local-scripts/
• upgrade the repository and pinned server/relay builders from Go 1.26.4 to the Go 1.26.5 security-fix release

Release and security notes

The published technical review is a report of reviewed commit e609ff86028c81bd149839e03d1ffc0eb2ee9e4a; it is not a release approval for later remediation commits. Suspected or unresolved vulnerability details remain excluded from public artifacts and routed through GitHub private vulnerability reporting. No v1-preview or production-readiness claim is made.

Validation

Phase 1 recorded successful formatting, Markdown-link, Go test, vet, race, build, PostgreSQL, S3-compatible storage, Valkey, full-stack, retry-path, relay, and bundle checks in disposable environments. Phase 2 independently reran the safe exact-SHA formatting, Markdown-link, Go test, and vet checks and validated citations, source pinning, disclosure safety, and cleanup.

For the Go 1.26.5 remediation commit, the following passed locally:

• go test ./...
• go vet ./...
• go run golang.org/x/vuln/cmd/govulncheck@v1.3.0 ./...
• the same govulncheck command under the official golang:1.26.5 container
• both server and stream-ingress Docker builds using golang:1.26-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2
• scripts/check-markdown-links.py
• git diff --check

Both GitHub Actions vulnerability scans now pass on Go 1.26.5. The push and pull-request runs also pass Go tests and PostgreSQL metadata tests; binary and image build jobs were still running at the last status check.