feat: add codex review support

[mcaxtr]

Summary

Adds rtk codex command that filters OpenAI Codex CLI review output, stripping preamble, intermediate tool calls, and metadata while preserving the actual review text. Achieves ~70% token savings.

Partial implementation of #169 — scoped to codex review for now, with the implementation designed to be easily extensible for full codex support later.

What it does

When an LLM agent runs codex review --base ${branch}, the raw output includes ~30 lines of CLI preamble, echoed user prompt, intermediate exec blocks (diffs, file reads), and the actual review buried at the end. rtk codex review --base ${branch} strips all that and returns only the review text.

Before (raw codex review output → LLM context)

OpenAI Codex v0.111.0 (research preview)
--------
workdir: /tmp/repo
model: gpt-5.3-codex
provider: openai
approval: never
sandbox: read-only
reasoning effort: xhigh
reasoning summaries: none
session id: 019cc9a9-401c-...
--------
user
changes against 'feature-branch'
mcp startup: no servers
exec
/usr/bin/zsh -lc 'git diff abc123' succeeded in 51ms:
diff --git a/math.py b/math.py
--- a/math.py
+++ b/math.py
@@ -1 +1,11 @@
+password = "hardcoded_secret_123"
exec
/usr/bin/zsh -lc 'nl -ba math.py' succeeded in 51ms:
     1  def add(a, b):
...
codex
The patch introduces a hardcoded password...

- [P1] Remove hardcoded credential from repository

After (rtk codex review → LLM context)

The patch introduces a hardcoded password...

- [P1] Remove hardcoded credential from repository

Implementation

State machine parser in src/codex_cmd.rs:

Preamble → UserPrompt → ExecBlock(s) → Body

• Preamble: Strips version header, config fields (workdir, model, session id, etc.)
• UserPrompt: Skips the echoed prompt and mcp startup lines
• ExecBlock: Strips all intermediate tool call output (diffs, file reads, shell commands)
• Body: Preserves the actual review text
• Fallback: Returns raw output for help text, errors, or truncated output from killed processes

Files changed

File	Change
src/codex_cmd.rs	New module: run(), filter_codex_output() state machine, is_preamble_line(), 9 tests
src/main.rs	mod codex_cmd, Commands::Codex variant, dispatch arm
src/discover/rules.rs	Pattern ^codex\s+review(\s|$) and RtkRule (category: AI, 70% savings)

Tests (9)

• test_filter_codex_review_output — full review output filtering
• test_filter_codex_output_no_exec_blocks — review without tool calls
• test_filter_alternating_exec_codex_blocks — multiple exec→codex cycles
• test_filter_codex_skips_user_prompt — user prompt stripped
• test_filter_preserves_blank_lines_in_body — paragraph formatting preserved
• test_filter_codex_fallback_to_raw_for_help — help text passthrough
• test_filter_codex_fallback_to_raw_for_errors — error passthrough
• test_filter_codex_output_empty — empty input handling
• test_token_savings — verifies ≥60% token reduction

Scope and future work

• This PR: codex review support with token-optimized filtering
• Future: The module structure and state machine are designed to be extended for additional codex subcommands as needed

Test plan

• cargo fmt --all --check
• cargo clippy --all-targets (no new warnings)
• cargo test codex_cmd:: — 9 tests pass
• cargo test discover:: — 154 tests pass
• Manual: rtk codex review --base ${branch} on real repo, verified filtered output
• Token savings ≥60% verified in automated test