[codex] Add PAT auth CI/CD e2e matrix

[shangguanxuan633-lab]

Summary

• Add an isolated PAT/login authorization E2E script for CI and release gates.
• Add a dedicated PAT Auth E2E GitHub Actions workflow for PR/push/manual runs.
• Run the same matrix in release.yml before GoReleaser as a CD gate.
• Keep the CI test-account hook on DWS_CI_TEST_* env vars/secrets, with offline fallbacks for forks.

Coverage

• Unauthenticated auth status and gateway auth classification.
• Direct auth login --token plus reset behavior.
• Seeded test-account profile with corp/user metadata in isolated keychain/config storage.
• PAT chmod session, agentCode, invalid agentCode, and batch --yes gates.
• CLI-owned and host-owned PAT stderr JSON for no-permission, auth-required, pending, and missing-agent cases.
• auth login --recommend plan/grant behavior for already-granted, unconfirmed, and confirmed flows.

Verification

• bash scripts/dev/test-pat-auth-e2e.sh --keep-workdir
• bash scripts/dev/test-pat-auth-e2e.sh --skip-go-tests
• git diff --check
• YAML parse check via Ruby YAML.load_file for the new PAT workflow and release workflow

Note: actionlint was not installed locally, so GitHub Actions will provide the final workflow validator.

[shangguanxuan633-lab]

PAT/Auth CI-CD matrix is ready on codex/pat-ci-cd-tests (cef1d6a).

What this PR adds:

• dedicated PAT Auth E2E workflow for PR/push/manual CI
• release/CD gate before GoReleaser using the same script
• isolated test-account profile path via DWS_CI_TEST_* vars/secrets, with offline fallback for fork safety
• coverage for unauthenticated login state, token login/reset, seeded corp/user profile, PAT chmod gates, CLI-owned vs host-owned PAT stderr JSON, and auth login --recommend plan/grant flows

Local verification passed:

• bash scripts/dev/test-pat-auth-e2e.sh --keep-workdir
• bash scripts/dev/test-pat-auth-e2e.sh --skip-go-tests
• git diff --check
• Ruby YAML parse check for .github/workflows/pat-auth-e2e.yml and .github/workflows/release.yml

actionlint was not installed locally, so Actions will be the final workflow syntax validator.

[shangguanxuan633-lab]

CI follow-up: all PR checks are green.

Passed checks:

• PAT/Auth Matrix
• Multi Profile E2E
• Lint
• Test
• Coverage
• Policy Check
• Edition Contract Tests

Notify Wukong Overlay is skipped as expected for PR events.

[PeterGuy326]

Closing this stale Draft because its workflow contract no longer matches the repository. It adds a tenth PR check and puts the full PAT matrix into the release path, while current main requires the exact nine Code Admission contexts and keeps environment/E2E coverage downstream or risk-selected. Its fixtures also predate the multi-account and pending PAT/auth changes. The test intent should be rebuilt after #687/#680 against the final auth model and Main Integration layering.