ci/security/test: automated audit fixes for CryptoLivePoolPipelines

[Pigbibi]

Summary

• redact secret-like findings in the Codex review gate instead of echoing matched values
• add regression coverage for the redaction behavior
• add pip check to CI dependency verification

Problems found

• scripts/gate_codex_app_review.py reported matched secret-like fragments directly in violation messages
• CI installed dependencies but did not run python -m pip check

Fixes applied

• normalize secret field names and emit <redacted> in gate findings
• add tests/test_gate_codex_app_review.py
• add Verify dependencies step to .github/workflows/ci.yml

Security impact

• reduces risk of secret-like values being echoed into CI logs or gate output
• no runtime publish targets, credentials, cloud config, or live-pool contract logic changed

Architecture impact

• low risk; audit gate output only, plus CI dependency verification

Tests run

• .venv-audit/bin/python -m pip check
• .venv-audit/bin/ruff check .
• .venv-audit/bin/python -m unittest tests.test_gate_codex_app_review -v
• .venv-audit/bin/python -m unittest discover -s tests -v
• actionlint
• git diff --check

Failed or skipped checks with reasons

• none

Deployment notes

• no deployment required

Rollback plan

• revert commit 594818c

Manual follow-up checklist

• confirm PR checks pass
• merge after branch protection requirements are satisfied