Add the codex review wrapper [ignore_release]

[snake14]

Description

Important

Blocked on repository access to the shared credentials, not on this change. The shared workflow declares its two secrets as required, and they are not available to this repository yet. Merging before that is granted would be worse than leaving it: a missing required secret fails at workflow-call validation with zero jobs and no comment, and leaves the trigger label stuck on, which reads as a broken review rather than a missing credential. This stays a draft until the access is in place.

Adds the codex-review wrapper so this plugin can be reviewed by Codex, bringing it in line with the plugins that already have one.

The wrapper points at matomo-org/plugin-ci-workflows/.github/workflows/plugin-codex-review.yml, the public shared workflow, rather than the private one some older callers use. GitHub resolves a reusable workflow from the callee repository's Actions access policy at parse time, before any job or secret exists, so a public repository cannot be granted access to a private one — it fails with "workflow was not found" and zero jobs, and no token or setting changes that. The shared workflow is the job structure that policy permits; the review logic stays private and is checked out with TESTS_ACCESS_TOKEN.

It triggers on pull_request_target: [labeled] and is gated on the codex-review label, so it does nothing until someone adds that label. The job-level if is deliberate rather than redundant: without it, adding any label would instantiate the shared workflow, claim its cancel-in-progress concurrency group, and cancel a review already running on the same pull request.

Two things worth knowing about when it becomes usable:

• pull_request_target only fires from the default branch's copy of a workflow, so this does nothing until it is merged — a repository whose default branch moved has silently dead codex review until the wrapper lands there.
• The shared OpenAI token is currently out of credits, so a review will not produce output yet. The wrapper is inert until labelled, so landing it now costs nothing and means one fewer repository to touch when credits return.

No version bump or changelog entry: this is CI configuration only.

Issue No

No GitHub issue.

Steps to Replicate the Issue

1. Add the codex-review label to a pull request in this repository.
2. Expected result: a Codex review runs, as it does on the plugins that already have the wrapper.
3. Actual result: nothing happens, because no workflow listens for that label here.

Checklist

• [✔] Tested locally or on demo2/demo3?
• [NA] New test case added/updated?
• [NA] Are all newly added texts included via translation?
• [NA] Are text sanitized properly? (Eg use of v-text v/s v-html for vue)
• [NA] Version bumped?
• [✔] I have understood, reviewed, and tested all AI outputs before use
• [✔] All AI instructions respect security, IP, and privacy rules
• [NA] Documentation updated?