chore(deps): add cooldowns and unify Codex dependencies

[mldangelo-oai]

Summary

Add automated dependency updates with no release-age delay for OpenAI dependencies and a seven-day cooldown for other releases. Keep the Codex CLI and SDK on one version across the shipping SDK, MCP app, and triage evals.

This PR is stacked on #755. Merge that PR first, then target this change at main.

Changes

• Configure daily Dependabot checks, including weekends, for the three npm projects, Python test dependencies, and GitHub Actions. Group Codex version and security updates across all three npm projects; group other OpenAI updates separately and third-party minor/patch updates together.
• Apply the same seven-day policy in each pnpm project, exempting openai and @openai/* while continuing to install committed lockfiles.
• Align the shipping Codex CLI and SDK dependencies with the evals at 0.151.0. Make Promptfoo's transitive SDK follow the evals' direct SDK dependency, removing the older duplicate.
• Add a CI regression check for matching direct pins and a single locked Codex SDK/CLI version, including platform packages. Preserve the existing Socket release checks.

Testing

• Dependabot configuration schema validation passed.
• Native pnpm fixture checks passed: both OpenAI package patterns accept a ten-minute-old release; a third-party package selects an eight-day-old release and rejects an exact pin inside the cooldown.
• Frozen installs passed for all three projects with pnpm 11.9.0; all Codex lockfile integrity hashes match public npm, and unrelated dependency graphs are unchanged.
• All 14 SDK skeleton tests passed. Negative controls confirmed the new check rejects a mismatched manifest and the prior duplicate transitive SDK.
• SDK and MCP typechecks, SDK Prettier checks, and all three required plugin portable source checks passed.
• All 11 deterministic eval scripts and Promptfoo configuration validation passed. Promptfoo initialized Codex SDK 0.151.0 and selected CLI 0.151.0; no model calls were made.

Risk and rollout

Dependabot begins scheduling updates after this configuration reaches the default branch. GitHub requires at least 24 hours between scheduled checks; this configuration runs daily at 09:00 UTC, including weekends. OpenAI releases become eligible on the next check without a cooldown; updates still require normal review and CI. Security updates are not delayed by the version-update cooldown. No auto-merge, registry credentials, or Socket policy changes are introduced.

The Codex dependency upgrade affects shipped runtime dependencies. The eval SDK override also applies to Promptfoo, so its deterministic checks and provider initialization were verified with the shared version. Existing locked third-party packages remain installable; the age policy applies when resolving new versions.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[mldangelo-oai]

@codex review

Please review the current head, 8adc82920a56558725fe985fec8bd5f292c864b5.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-30T14:48:47.229497Z	9cb81fd	Manual request
🔒 Security Review	✅ Completed 2026-08-30T14:47:58.213317Z	9cb81fd	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8adc82920a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[mldangelo-oai]

@codex review

Please review the updated head, a72608079e8f8700882e4484160ca733917f57d1.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: a72608079e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[mldangelo-oai]

@codex review

Please review the updated head, 9cb81fdcbfa524b8e75834c81f8665ec367aad6c.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Nice work!

Reviewed commit: 9cb81fdcbf

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[mldangelo-oai]

Final validation:

• CI at 9cb81fdcbfa524b8e75834c81f8665ec367aad6c: 35 successful checks, 5 skipped, and no failures or pending checks, including successful GitHub Dependabot configuration validation.
• Both full local SDK suites passed: seed 12345 and the default randomized run with seed 2608157143, each with 2,112 passed, 43 skipped, and 0 failed tests.
• Codex code and security reviews completed on this head. The security-update grouping feedback is addressed, with no unresolved review threads.

No model-backed evals, merge, or release was performed.