Disable OpenAI Codex from all pipelines (security risk)

[AndrewAltimit]

Summary

• Disabled OpenAI Codex from CI/CD pipelines, MCP services, and Docker Compose due to OpenAI's partnerships with governments conducting mass surveillance and enabling autonomous weapons
• Added security advisories to README.md and AGENTS.md explaining the rationale and recommending Anthropic models (Claude) instead
• All Codex config is commented out / preserved (not deleted) so it can be re-evaluated if OpenAI's policies change

Changes

• pr-validation.yml: Codex review job commented out, removed from all downstream needs lists, status summary shows "disabled"
• .mcp.json: Removed codex MCP server entry
• docker-compose.yml: Commented out mcp-codex service with security rationale
• .agents.yaml: Added commented-out codex entry with explanation, updated gemini model config
• AGENTS.md: Full security advisory section, agent table updated with DISABLED status, all Codex references struck through
• README.md: Security notice blockquote at the top
• CLAUDE.md: Updated pipeline and Docker descriptions

Test plan

• Verify pr-validation.yml passes actionlint (pre-commit hook confirms this)
• Verify .mcp.json and docker-compose.yml are valid (validated via python yaml/json parsers)
• Confirm no remaining active references to codex in pipeline job dependencies
• CI passes without codex-review job

Generated with Claude Code