ci: harden Codex rails reusable workflow

[haasonsaas]

Summary

• trigger the org Codex rails check for nested AGENTS.md files
• validate every AGENTS.md file discovered in a repository
• add read-only workflow permissions and pin actions/checkout by commit SHA

Test plan

• actionlint .github/workflows/codex-rails-check.yml
• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/codex-rails-check.yml")'

[cursor]

PR Summary

Low Risk
Low risk: limited to CI workflow triggers and validation logic, with the main impact being stricter checks that could fail PRs if nested AGENTS.md files are empty or missing when required.

Overview
Expands the codex-rails-check workflow to trigger on changes to nested **/AGENTS.md files and updates validation to scan all AGENTS.md files in the repo (failing if any are empty, and optionally failing if the root file is missing when require_agents is true).

Hardens the workflow by setting read-only contents permissions and pinning actions/checkout to a specific commit SHA.

^{Reviewed by Cursor Bugbot for commit 569a23b. Bugbot is set up for automated code reviews on this repo. Configure here.}