ci: remove codex review gate and upgrade actions

.github/actions/setup-project/action.yml

@@ -5,7 +5,7 @@ runs:
   using: composite
   steps:
     - name: Set up pnpm and Node
-      uses: pnpm/setup@v1
+      uses: pnpm/setup@v2.1.0
       with:
         runtime: node@24
         cache: true

.github/workflows/ci.yml

@@ -19,38 +19,13 @@ env:
   LEFTHOOK: "0"
 
 jobs:
-  codex-review:
-    name: Codex Review
-    if: github.event_name == 'pull_request'
-    runs-on: ubuntu-latest
-    timeout-minutes: 35
-    permissions:
-      contents: read
-      issues: read
-      pull-requests: read
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          persist-credentials: false
-
-      - name: Test review gate
-        run: node --test .github/scripts/codex-review.test.cjs
-
-      - name: Wait for completed Codex review
-        uses: actions/github-script@v8
-        with:
-          script: |
-            const {waitForReview} = require('./.github/scripts/codex-review.cjs')
-            await waitForReview({github, context, core})
-
   formatting:
     name: Formatting
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7.0.1
 
       - name: Set up project
         uses: ./.github/actions/setup-project
@@ -64,7 +39,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7.0.1
 
       - name: Set up project
         id: setup
@@ -83,7 +58,7 @@ jobs:
 
       - name: Upload build
         if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: build
           path: packages/client/dist
@@ -96,7 +71,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7.0.1
 
       - name: Set up project
         id: setup
@@ -122,11 +97,11 @@ jobs:
         working-directory: cli
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7.0.1
 
       - name: Set up Ruff
         id: setup
-        uses: astral-sh/ruff-action@v4.0.0
+        uses: astral-sh/ruff-action@v4.1.0
         with:
           version: "0.16.6"
           args: "--version"
@@ -146,13 +121,13 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7.0.1
 
       - name: Set up project
         uses: ./.github/actions/setup-project
 
       - name: Download build
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@v8.0.1
         with:
           name: build
           path: packages/client/dist