fix: use supported Codex exec configuration

[robbycochran]

The pinned sandbox Codex CLI rejected the legacy --ask-for-approval and related CLI arguments before the reviewer started.

Move model, approval, and sandbox settings into the existing Codex config payload and keep the command line to the flags supported by the pinned image. Add a regression assertion for the obsolete flags.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Repository: stackrox/harness-openshell/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 0d853c83-9afd-4ab0-85bd-56495a1e3892

📥 Commits

Reviewing files that changed from the base of the PR and between 09b3931 and 169b0b8.

📒 Files selected for processing (2)

• tasks/github-pr-reviewer/workflow/codex-harness.yaml
• test/pr_review_test.go

 _____________________________________________________________
< Return early? Yes. Return *something meaningful*? Also yes. >
 -------------------------------------------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}