[codex] add dependency matrix sync and CI gates

[Pigbibi]

Summary

• Add generated/sync workflow for internal dependency matrix from local consumer pins.
• Document the matrix regeneration flow in English and Chinese.
• Add package README metadata and actionlint CI coverage.

Validation

• actionlint
• git diff --check
• python3 -m pytest python/tests/test_internal_dependency_matrix.py python/tests/test_gate_codex_app_review.py -q
• python3 python/scripts/check_internal_dependency_matrix.py --strict --require-consumer-files
• python -m build ./python

[github-actions]

🤖 Codex PR Review

⚠️ Review skipped: The Codex review could not be completed.

No Codex service URL or API key configured. Set CODEX_AUDIT_SERVICE_URL, ANTHROPIC_API_KEY, or OPENAI_API_KEY.

Please ensure a human reviewer checks this PR before merging.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9c03b7fe08

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Guard --sync against empty consumer scans

When --sync is run from a standalone QuantRuntimeSettings checkout or before sibling consumer repos are cloned, collect_dependency_pins_from_projects returns no pins and this line overwrites internal_dependency_matrix.json with dependencies: []. I checked the follow-up strict path: with an empty matrix, --strict --require-consumer-files checks zero files and exits 0, so a mistaken sync can remove all matrix coverage without CI catching it. Please fail or require the expected consumers before writing.

Useful? React with 👍 / 👎.