Codex Review:\n\nFindings:

1. Formatting regression in posted PR comment
   File: .github/workflows/codex-review.yml
   The new multiline format(...) string introduces leading spaces before {0}:

   format('## Codex Review
                 {0}', ...)

   That indentation becomes part of the rendered comment body, so the first line of Codex output is prefixed with many spaces (and can render as a code block / malformed markdown).
   Fix: Build the heading/body in github-script (JS template literal with explicit \n\n), or ensure {0} is not preceded by indentation in the expression output.

No direct security issue found in this change.
Testing gap: this workflow formatting path is untested; a small assertion in CI (or a local workflow test harness) for final comment rendering would prevent regressions like this.