Add fail-closed Slack to Codex control plane

[kubbot]

Summary

• declare one desired Codex environment per active public repository and keep every unverified target fail-closed
• add a Slack task envelope, secret-aware validator, and read-only AGENTS/code-review health audit
• connect the contract to daily ops, weekly Evals, Slack routing, and a minimal pinned-SHA CI workflow

Safety boundary

• does not install Slack or Codex apps, grant OAuth, change repository access, deploy, rotate secrets, or post messages
• private signing and credential repositories remain excluded
• pending targets cannot pass the dispatcher validator outside explicit test mode

Verification

• automation/scripts/registry.test.sh
• git diff --check
• live read-only automation/scripts/codex-review-health.sh: 6/6 repositories available; all targets pending verification; five repositories missing Code Review Rules and FitCoach missing AGENTS.md
• verified checkout pin 08c6903cd8c0fde910a37f88322edcfb5dd907a8 resolves to actions/checkout v5.0.0

[ecc-tools]

Analyzing 200 commits...

[ecc-tools]

Analysis Failed

refs/heads/ecc-tools/.github-1787834579022 is not a valid ref name. - https://docs.github.com/rest/git/refs#create-a-reference

Troubleshooting

Cause	Resolution
Large repository	Analysis may timeout on repos with extensive history
API rate limits	Wait 15 minutes before retrying
Network issues	Queue timeout is 15 minutes; retry may succeed
Permissions	Verify app has Contents: Read access

Retry: /ecc-tools analyze

---

_{Report Issue | ECC Tools}