ci: add codex-plugin-scanner workflow

[internet-dot]

I opened this to add a scanner-only check for the Codex plugin surface in the repo.

A couple of repo-specific details I checked first:

• | Delegated runtime | Codex app-server + broker | Fresh claude -p subprocess per invocation |
• Nested helper sessions suppress stop-time review and unread-result prompts, so user-facing hooks stay attached to the top-level Codex thread instead of recursive child runs
• The installer is idempotent and manages the personal marketplace entry, Codex hook installation, and Codex app-server install/uninstall path together

The current local scan came back 85/100 (grade B).

This PR only adds the scanner workflow. It does not touch runtime code or release behavior.
If you would rather wire it in a different workflow file, I can adjust the branch.