perf(ci): cache torch wheel in pip-audit.yml; add codex.yml concurrency guard

[cgfixit]

What

Two small, unrelated-but-small CI hygiene fixes bundled together (both "license/secret/key-free enhancement" per the CyClaw-Optimize scope):

1. pip-audit.yml: verify-install job now caches pip downloads (via setup-python's cache: 'pip') and caches the torch CPU wheel separately (via a dedicated actions/cache step keyed on runner.os + the pin), mirroring ci.yml's existing two-tier caching exactly.
2. codex.yml: added a concurrency block, mirroring the one already on claude.yml.

Why / benefit

1. pip-audit.yml triggers on push/pull_request to requirements.txt or constraints.txt — which means its pip cache is guaranteed to bust on the one event that matters most, and without a separate torch cache it re-downloads the ~2GB CPU wheel on both OS legs every time those files change. ci.yml already solved this with a dedicated torch-wheel cache; pip-audit.yml never got the same treatment.
2. codex.yml and claude.yml are near-identical issue_comment-triggered PR-bot workflows (checkout PR merge ref → run agent → post comment), but only claude.yml has a concurrency guard. Rapid repeat @codex comments on the same PR could run overlapping jobs against the same refs/pull/N/merge ref with no guard.

Risk to monitor

Both changes are additive (new cache steps / a concurrency block) — no existing step was removed or reordered beyond inserting the cache steps. Worst case on a cache miss is identical behavior to today (fresh download), so there's no plausible way this makes the job slower or less correct, only sometimes faster. codex.yml's cancel-in-progress: true is unconditional (matching claude.yml's exact policy) since this workflow has no analogous "push to main" case to exempt.

Verify

Both files parse as valid YAML (yaml.safe_load). No Python code touched — this is a CI-workflow-only change validated by the repo's own CI on push, per the skill's documented exception for YAML/lint-only PRs.

Scan context

CyClaw-Optimize (ponytail + Karpathy + fable-protocol loaded). Findings #1 and #2 of an 8-finding scan; deduped against open PRs #473, #477, #415.

---

Generated by Claude Code

[chatgpt-codex-connector]

Summary

• Reviewed the PR follow-up context and validated the current workflow edits; I did not find a follow-up code change that needs a new PR.
• Confirmed pip-audit.yml now uses setup-python pip caching with requirements.txt, constraints.txt, and pyproject.toml as cache dependencies. .github/workflows/pip-audit.ymlL38-L50
• Confirmed pip-audit.yml now has a separate pinned torch CPU wheel cache and cache-miss download/install path. .github/workflows/pip-audit.ymlL56-L86
• Confirmed codex.yml now has a PR-comment concurrency guard with cancel-in-progress: true. .github/workflows/codex.ymlL7-L10
• No files were modified in this follow-up, so I did not commit or create a new PR.

Testing

• ✅ python - <<'PY' import yaml for p in ['.github/workflows/pip-audit.yml','.github/workflows/codex.yml']: with open(p, 'r', encoding='utf-8') as f: yaml.safe_load(f) print(f'OK {p}') PY
• ✅ git status --short

View task →