ci(security): harden daily Codex scan

[jason-allen-oneal]

Replaces the broken duplicated Codex Security workflow with the hardened reusable scanner pinned to immutable odinn-maintainer commit d78c18b.

• Targets this repository and its configured default branch.
• Uses read-only repository permissions.
• Pins Codex Security, proves the Linux sandbox, and uses the approved bounded model configuration centrally.
• Encrypts all retained scan outputs and never publishes raw findings or SARIF.
• Staggers the daily schedule to avoid cross-repository OAuth/model races.

Validation: caller YAML parses and git diff --check passes. The reusable implementation passed 39/39 tests before merge.