Persist upstream Radar review artifacts

[yvette-carlisle]

Summary

• Refreshed artifacts/github/review-queue/openai-codex-latest.json from the deterministic upstream review queue.
• Added GitHub change bundles, source-backed upstream_review/v1, upstream_impact/v1, and social_candidate/v1 artifacts for openai/codex PRs 27602, 27461, and 27893.
• Wrote only Publisher handoff candidates; no social_post/v1 records were written and nothing was published to X.

Reviewed subjects

• [codex] Preserve plugin apps in connector listings openai/codex#27602: auth-aware plugin App visibility in app/connector listings.
• [codex] Skip plugin MCP OAuth for matching app routes openai/codex#27461: auth-aware dual App/MCP plugin MCP OAuth filtering.
• Activate selected executor plugin MCPs in app-server openai/codex#27893: selected executor plugin stdio MCP activation through app-server selectedCapabilityRoots.

Validation

• cargo run -p decodex --bin decodex -- radar validate -> OK (539 Radar artifact JSON files validated)
• jq empty on the changed queue, bundle, review, impact, and social-candidate JSON artifacts.
• Candidate text lengths checked at 219, 192, and 208 characters.

Notes

The diff is limited to allowed Radar artifact paths under artifacts/github/review-queue/, artifacts/github/bundles/, artifacts/github/reviews/, artifacts/github/impact/, and artifacts/github/social-candidates/.