[codex] Apply audit remediation

[Pigbibi]

Summary

• apply the 2026-06-10 audit remediation items
• tighten GitHub workflow permissions, job timeouts, and scheduled/manual concurrency where applicable
• add focused characterization or governance checks where this repository has runtime-facing changes

Validation

• targeted local tests and lint checks were run before publishing
• workflow governance scan passed across the remediation scope
• git diff --check passed across the remediation scope

See local audit report: QuantStrategyLab-review-2026-06-10.md.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: dcbb34cdf2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Raise deploy job timeout above wait loop

When env sync waits for Cloud Run to reach the current commit, the workflow still allows the wait loop to run for up to 1800 seconds per service, but this new 20-minute job timeout kills the entire job before that loop can reach its own deadline. In any deployment where image build/push/deploy plus propagation takes more than the remaining job time, the job now fails from the GitHub timeout instead of completing or emitting the script's intended timeout message, so the job timeout should be greater than the longest expected wait path.

Useful? React with 👍 / 👎.