Codex / agent CLI task

# DevAgentRadar → OpenAI Codex

Task: evaluate and optionally implement follow-ups from this coding-assistant release.

## Context
Assistant: OpenAI Codex CLI
Proposal: Upgrade Codex CLI to rust-v0.146.1 for safer cyber-model auto-review defaults
Summary: Pin or upgrade OpenAI Codex CLI to rust-v0.146.1 so cyber-capable models use the backported safer automatic-review defaults, and train the team to read the new terminal explanations when permissions change.
Primary source: https://github.com/openai/codex/releases/tag/rust-v0.146.1

## Why it matters
rust-v0.146.1 backports safer automatic-review defaults for cyber-capable models and surfaces explanations of permission changes in the terminal UI (#37057). Teams still on 0.146.0 (or earlier) keep the prior auto-review posture and may miss why permissions shifted mid-session. Standardizing on this patch reduces risky auto-review behavior for cyber-capable models and makes permission deltas legible during CLI use, without requiring workflow redesign beyond the upgrade and a short habit change around reading the new terminal messages.

## Suggested actions
1. Run: `npm install -g @openai/codex@rust-v0.146.1` (or your install path’s equivalent) and confirm with `codex --version` that it reports rust-v0.146.1 / 0.146.1.
2. In your repo or dotfiles, pin the Codex CLI version to `rust-v0.146.1` (e.g. in the tool version file, Devcontainer feature pin, or team install script) so local and CI agents do not drift back to 0.146.0.
3. Paste to your coding agent: `After upgrading Codex CLI to rust-v0.146.1, start a short session with a cyber-capable model and stop at the first automatic-review or permission-change prompt; quote the new terminal explanation text verbatim into the PR/notes so we capture the safer defaults messaging.`
4. Add a one-line team rule: `On Codex CLI ≥ rust-v0.146.1, do not dismiss permission-change notices in the terminal; copy the explanation into the session log before accepting or denying.`
5. Announce in the eng channel: `Codex CLI rust-v0.146.1 backports safer auto-review defaults for cyber-capable models and explains permission changes in-terminal (#37057)—upgrade today and re-run any playbooks that relied on previous auto-review behavior.`


Deliverables:
- Short impact assessment
- Optional patch plan (files + steps)
- Do not invent APIs not in the source notes