ci: repair GitHub Actions dependency train

[andrei-hasna]

Summary

Combines the PR0 wave2 GitHub Actions workflow train into one rebased repair PR on current main:

• incorporates the workflow action pin bumps from chore(deps): bump actions/cache/restore from 5.0.4 to 6.1.0 #188, chore(deps): bump pnpm/action-setup from 5.0.0 to 6.0.9 #189, chore(deps): bump actions/cache from 5.0.4 to 6.1.0 #190, chore(deps): bump actions/cache/save from 5.0.4 to 6.1.0 #191, and chore(deps): bump actions/checkout from 6.0.2 to 7.0.0 #192
• incorporates the clean-prefix npm/Bun install-smoke coverage from test(install-smoke): add clean-prefix npm and Bun install smoke tests #183
• fixes stale v8-canary.yml version comments left by chore(deps): bump actions/cache from 5.0.4 to 6.1.0 #190/chore(deps): bump actions/checkout from 6.0.2 to 7.0.0 #192 and a follow-up reviewer catch on actions/setup-python
• avoids the test(install-smoke): add clean-prefix npm and Bun install smoke tests #183 Co-Authored-By trailer by using a clean replacement commit
• makes the install-smoke CI step strict via CODEWITH_SMOKE_STRICT=1, so npm/Bun offline install failures fail CI instead of being reported as skipped smoke coverage

Decision: combine rather than sequence. The original PRs are all stale/red workflow/install-smoke changes against older bases and several touch the same workflow files. A combined branch gives one current-main validation surface instead of rebasing and rerunning a chain of overlapping workflow-only PRs.

Supersedes/validates: #183, #188, #189, #190, #191, #192.

Task evidence: PR0 wave2 worker 563b5d15 / umbrella f67fdf41-f20e-43d9-850a-bf86d7d66495 / fingerprint pr0-codewith-wave2-github-actions-train-2026-07-09.

Validation

• python3 -m unittest codex-cli/scripts/test_install_smoke.py -> OK, 3 tests, 1 registry-gated skip
• CODEWITH_SMOKE_STRICT=1 python3 -m unittest codex-cli/scripts/test_install_smoke.py -> OK, 3 tests, 1 registry-gated skip
• python3 -m unittest codex-cli/scripts/test_build_npm_package.py -> OK, 5 tests
• node --test in codex-cli/ -> OK, 6 tests
• Python workflow YAML parse over .github/workflows/*.yml -> OK, 24 files
• python3 .github/scripts/test_bazel_workflow.py -> OK, 2 tests
• python3 .github/scripts/test_sdk_workflow.py -> OK, 2 tests
• pnpm install --frozen-lockfile -> OK
• pnpm run format -> OK
• stale version comment / generated trailer scans -> OK
• git diff --check -> OK
• staged-diff secret scans before commit/amend -> OK, no secret-like values detected
• commit-diff secret scans before push/force-push -> OK, no secret-like values detected

Local gap: actionlint is not installed on this machine (command not found), so workflow validation used YAML parse plus the repo's workflow contract tests. GitHub Actions should still be treated as the authoritative workflow gate.

Current known external blocker: GitHub cargo-deny has been failing on main and failed this PR's first run on RUSTSEC-2026-0204 for crossbeam-epoch 0.9.18; this PR changes no Cargo files. The current push reruns checks and should still be considered not merge-ready until live checks complete or that repo-wide advisory blocker is handled.

Merge policy

Do not merge from this worker. Wait for current GitHub Actions and adversarial review reconciliation.

[andrei-hasna]

Follow-up triage/update for task 1af8617a / umbrella f67fdf41-f20e-43d9-850a-bf86d7d66495:\n\n- Rebased this PR onto current main (8217e6c) and updated head to 59b4000 with exact force-with-lease.\n- Cargo-deny failure was stale dependency baseline: current main now carries the crossbeam-epoch fix from #209, and cargo-deny passes locally and in hosted checks on this head.\n- Shared Bazel failure across #206/#207/#208 was not PR-specific: Bazel could not see codex-rs/state/src/runtime/fixtures/goals_0148_0005_thread_goal_deferred.sql even though it exists in git. This PR now carries the targeted codex-rs/state BUILD.bazel compile_data fix.\n- Local validation: git diff --check; install-smoke tests strict/non-strict OK; test_build_npm_package OK; node --test OK; workflow YAML parse OK; cargo deny check OK; bazel build //codex-rs/state:state-unit-tests-bin OK; staged gitleaks OK; commit-range gitleaks OK.\n- Native codewith adversarial review against origin/main found no actionable correctness issues.\n\nMerge policy: do not merge until the current hosted checks on 59b4000 complete cleanly. #207 should stay ordered behind this CI-train fix or be explicitly stacked only if that review noise is acceptable.

[andrei-hasna]

Closing as superseded by clean replacement #249. The replacement was rebuilt from current main rather than cherry-picking the stale dependency/workflow train. Exact replacement head de8cafd3237b6cf8470d68dea9756e56e2132148 passed E2B exact-head merge, package-builder, npm/Bun clean-prefix smoke, Node 22 workspace build, Prettier, 63 workflow-helper tests, pin-count, and secret-scan gates. #249 preserves the newer workflow fixes already on main and excludes the redundant codex-rs/state/BUILD.bazel hunk.