Classify Codex exec failures separately

[Pigbibi]

Summary

• classify codex exec failed output separately from service auth/config errors
• keep quota/capacity signals recoverable for API fallback
• avoid source-code snippets containing not allowed or allowlist being treated as auth failures

Tests

• python3 -m ruff check scripts/run_monthly_codex_audit.py scripts/codex_audit_service.py service/ai_gateway_service.py tests/test_run_monthly_codex_audit.py
• python3 -m unittest tests.test_run_monthly_codex_audit.RunMonthlyCodexAuditTests.test_service_failure_classification_identifies_infra_failures tests.test_run_monthly_codex_audit.RunMonthlyCodexAuditTests.test_service_failure_classification_ignores_source_code_secret_words
• python3 -m unittest discover -s tests
• git diff --check

[github-actions]

🤖 Codex PR Review

⚠️ Review skipped: The Codex review could not be completed.

Codex service request failed: 401 {"error": "OIDC workflow_ref is not allowed"}

Please ensure a human reviewer checks this PR before merging.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 30ed78e205

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve auth classification for Codex exec errors

This early return bypasses the broader auth/config signals below for every codex exec failed stderr. If the Codex CLI reports auth problems as Unauthorized, Forbidden, api key is required, missing token, etc. without the exact 401 unauthorized/403 forbidden/invalid api key phrases in the new helper, the service records unknown_failure; the monthly bridge then treats a service auth/config outage as a normal job failure and can run API fallback instead of failing closed with an infra comment. Please keep the existing auth signals available for genuine Codex stderr after filtering the source-code false positives.

Useful? React with 👍 / 👎.