🤖 fix: distinguish Codex status comments from unresolved findings - #4149

Reuse the classifier merged in #4149 without changing its blocking policy. Completed status and no-findings results remain pending until explicit approval, while findings and account errors still fail.

---

_Generated with `xum` • Model: `openai:gpt-6-astra` • Thinking: `xhigh` • Cost: `$24.58`_

<!-- mux-attribution: model=openai:gpt-6-astra thinking=xhigh costs=24.58 -->

…oder#4151)

## Summary

Follow up on coder#4149 so completed informational Codex results do not make
the review waiter fail before its explicit approval signal arrives. The
classifier fix merged while this PR was under review; this PR now
preserves that implementation unchanged and contains only the missing
waiter behavior and regression coverage.

## Implementation

- Reuse the merged classifier to exclude authenticated, completed status
summaries and clean-security envelopes from the waiter’s
substantive-response count.
- Keep polling for explicit approval rather than treating an
informational result as either approval or a failed review.
- Preserve the merged blocking policy for unfinished/unknown envelopes,
real findings, unresolved threads, and account errors.

## Validation

`make test-codex-comments` passes all 11 regression groups, including
completed-result polling, stale/foreign approval signals, findings
alongside informational comments, and account errors. `make
static-check` passes.

## Risks

This only changes the waiter’s non-terminal state; the CI classifier,
comment-resolution checks, and approval/freshness requirements are
unchanged.

---

_Generated with `xum` • Model: `openai:gpt-6-astra` • Thinking: `xhigh`
• Cost: `$24.58`_

<!-- mux-attribution: model=openai:gpt-6-astra thinking=xhigh
costs=24.58 -->

> Stacked on coder#4151 (approval-waiter follow-up to the checker fix merged
in coder#4149). Merge coder#4151 first; the diff against this PR's base remains
spacing-only.

## Summary

Keep all nested tool cards inset from the Code Execution border. The
shared nested-tools container was cancelling its parent's horizontal
padding with negative margins, so bordered cards such as
`task_send_message` sat against the dashed frame. Removing that override
fixes the shared layout rather than adding tool-specific spacing
workarounds.

## Validation

- Added full-app desktop and phone stories covering `agent_report`,
`file_read`, and `task_send_message`, including collapsed/expanded
message cards. Geometry assertions verify border clearance, separation
between tools, and no horizontal overflow.
- Confirmed the new tests fail before the fix (1px edge clearance) and
pass afterward. Storybook-manager checks at 375px and 1280px measured
13px clearance on both sides.
- `make static-check` passed; 7 full-app Storybook tests and 63 targeted
tool-renderer/unit tests passed.

<details>
<summary>Existing local validation limitation</summary>

The isolated `CodeExecutionToolCall` gallery has a Vite development-time
circular-import error (`Cannot access 'CodeExecutionToolCall' before
initialization`). Reproduced with the original production file as well.
The full-app code-execution and agent-communication stories pass.

</details>

---

_Generated with `xum` • Model: `openai:gpt-6-astra` • Thinking: `xhigh`
• Cost: `$24.54`_

<!-- mux-attribution: model=openai:gpt-6-astra thinking=xhigh
costs=24.54 -->

…oder#4223)

## Summary

The `Codex Comments` gate treats Codex's review summary board as a
blocking comment whenever it carries a "Security findings" section, even
after every advisory thread is resolved and both reviews are complete.
This whitelists the section when each advisory bullet carries Codex's
own **Resolved** marker, so PRs that once had a security advisory can
pass `Required` again. Unblocks coder#4211.

## Background

Codex keeps resolved security advisories listed on the board and only
adds the `· **Resolved**` marker when a later review completes (verified
from the board's edit history on coder#4211: the marker appeared at the next
review completion, not when the thread was resolved). The gate's line
whitelist (coder#4149, coder#4158) does not know the section, so a completed board
with resolved advisories is reported as an unresolved Codex comment and
`Required` can never go green. On coder#4211 the gate log at 17:24Z shows
exactly that: `status: completed`, both rows Completed, two
`**Resolved**` advisories, still counted as blocking. The two most
recent merged PRs with such boards (coder#4170, coder#4176) only passed because
the section was added after their last gate run.

## Implementation

`scripts/lib/codex_comments.jq` accepts three more line shapes inside a
completed board: `### Security findings`, `#### Advisory findings (N)`,
and a bullet that links a review thread on a PR
(`.../pull/N#discussion_r<id>`), names a severity, and ends with `·
**Resolved**`. A bullet without the marker is a live finding and keeps
blocking, as do unknown sections, non-thread links, and trailing text.

## Validation

- `python3 scripts/check_codex_comments_test.py`: the existing
unresolved-advisory case still expects blocking; new cases cover the
resolved board (informational) and three malformed variants (still
blocking). Red without the jq change: the resolved case fails `1 != 0`.
- The new jq evaluated against real boards: coder#4211's completed board with
two resolved advisories is informational; its running board and coder#4176's
board (unresolved advisory) stay blocking.

---

_Generated with `xum` • Model: `anthropic:claude-fable-5-1` • Thinking:
`xhigh` • Cost: `$16.42`_

<!-- mux-attribution: model=anthropic:claude-fable-5-1 thinking=xhigh
costs=16.42 -->