Add controlled Codex qualification workflow

.github/workflows/plananvil-codex-qualification.yml

@@ -0,0 +1,50 @@
+name: PlanAnvil Codex qualification
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: plananvil-codex-qualification
+  cancel-in-progress: false
+
+jobs:
+  smoke:
+    name: codex smoke test
+    if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main'
+    environment: plananvil-codex
+    runs-on:
+      - self-hosted
+      - linux
+      - x64
+      - plananvil
+      - codex
+    timeout-minutes: 10
+    steps:
+      - name: Validate controlled runner
+        shell: bash
+        run: |
+          set -euo pipefail
+          test "${GITHUB_REF}" = "refs/heads/main"
+          command -v plananvil-qualification-workspace
+          command -v codex
+          codex --version
+
+      - name: Run Codex smoke test
+        shell: bash
+        run: |
+          set -euo pipefail
+          workspace="$(plananvil-qualification-workspace)"
+          test -n "${workspace}"
+          test -d "${workspace}"
+          cd "${workspace}"
+          git rev-parse --is-inside-work-tree
+
+          before="$(git status --porcelain=v1 --untracked-files=all)"
+          output="$(codex exec --ephemeral 'Do not modify any files. Reply with exactly PLANANVIL_CODEX_SMOKE_OK.')"
+          printf '%s\n' "${output}"
+          printf '%s\n' "${output}" | grep -Fq 'PLANANVIL_CODEX_SMOKE_OK'
+          after="$(git status --porcelain=v1 --untracked-files=all)"
+          test "${before}" = "${after}"