fix: audit batch — MCP timeouts, entryPost, vip_audit 404s, and 6 more (#824)

* fix: 9 unaddressed log-audit / run-audit findings

Co-authored-by: Cursor <cursoragent@cursor.com>

#815 entryPost stdlib-only imports; #823 MCP timeoutMs on checkout_pr/shell;
#816 FREE_FALLBACK → opencode/big-pickle; #822 chunk GraphQL nodes ≤100;
#817/#821 vip_audit 404 skip paths; #813 longer serializable retries;
#818 run-context handler-entered log; #805 audit severity template.

* fix: update footer test for big-pickle fallback slug

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix: anneal round 1 — ghaCore getState casing, post-hook timeout

Match @actions/core STATE_ key semantics (no uppercasing), cap
postApiFetch at 30s, trim serializable retries to stay under GitHub's
10s webhook window, log Clerk failures in getUserTokenByGithubLogin.

Co-authored-by: Cursor <cursoragent@cursor.com>

* revert: drop run-context handler log (#818 deferred)

The #692 client-side fix is already on main; residual SyntaxError hits
are old action pins. Per-request log added noise without fixing anything.

Co-authored-by: Cursor <cursoragent@cursor.com>

* document per-issue Closes syntax for audit PRs

GitHub only auto-closes the first issue when numbers are comma-separated;
/audits and AGENTS.md now require Closes before each issue number.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix: anneal round 2 — outreach privacy, alert resilience, vertex cleanup

Filter private repos from VIP authority output, harden console alert
lines against DB failures, drop spoofable changesets body check, and
unset GOOGLE_APPLICATION_CREDENTIALS after vertex credential cleanup.

Co-authored-by: Cursor <cursoragent@cursor.com>

* refactor: drop codexHome re-export of detectCodexRefresh

Import detectCodexRefresh directly from codexRefreshDetect.ts everywhere;
rename the unit test file to match. codexHome.ts stays install-only.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix: drop deprecated minimax-m2.5-free; add paid minimax-m2.5

Remove the deprecated free MiniMax promo from the catalog, docs, and
tests. BYOK fallback and picker copy stay on opencode/big-pickle. Add
opencode/minimax-m2.5 and openrouter/minimax-m2.5 for Zen BYOK and
Router. Pin #816 regressions with freeFallbackCatalog and runErrorRenderer
unit tests.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix: hidden minimax-m2.5-free fallback for stored slugs

Re-add opencode/minimax-m2.5-free as a hidden fallback alias to big-pickle
so repos with the legacy slug still resolve as free. Drop live Zen API
experiment tests in freeFallbackCatalog.test.ts.

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: Cursor <cursoragent@cursor.com>

entryPost.ts

@@ -24,11 +24,14 @@
 // saved). Best-effort: failures are logged but never throw — the workflow
 // is already done, and a missed refresh write-back means the user re-runs
 // `pullfrog auth codex` next time the chain breaks.
+//
+// Imports here MUST stay stdlib-only — GHA runs this file directly from the
+// checked-out action repo, which has no node_modules for sha-pinned consumers.
 
 import { existsSync, readFileSync } from "node:fs";
-import * as core from "@actions/core";
-import { apiFetch } from "./utils/apiFetch.ts";
-import { detectCodexRefresh } from "./utils/codexHome.ts";
+import { detectCodexRefresh } from "./utils/codexRefreshDetect.ts";
+import * as core from "./utils/ghaCore.ts";
+import { postApiFetch } from "./utils/postApiFetch.ts";
 
 async function main(): Promise<void> {
   const raw = core.getState("codex_writeback");
@@ -72,11 +75,7 @@ async function main(): Promise<void> {
   }
 
   try {
-    // route through apiFetch so the Vercel preview-deployment SSO gate gets
-    // the `x-vercel-protection-bypass` header/query (raw fetch silently 401s
-    // against preview envs — production is unaffected but every preview-run
-    // refresh would be lost). see action/utils/apiFetch.ts.
-    const response = await apiFetch({
+    const response = await postApiFetch({
       path: "/api/runtime/secret",
       method: "PUT",
       headers: {
@@ -97,6 +96,5 @@ async function main(): Promise<void> {
 }
 
 main().catch((err) => {
-  // never throw — post-hook failure must not fail the workflow
   core.warning(`codex post-hook: unexpected error — ${err}`);
 });