docs: add GitHub MCP Actions example

[pollychen-lab]

Summary

• document how to configure the hosted GitHub MCP server for Codex inside a GitHub Actions workflow
• show a temporary codex-home config and PR-review prompt that can use GitHub MCP tools to add review comments
• link to the official GitHub MCP Server Codex installation guide for current token and server options

Validation

• git diff --check
• pnpm run check
• pnpm test

Closes #60

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[pollychen-lab]

I have read the CLA Document and I hereby sign the CLA

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fbe96aefd6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Disable persistence of the write-capable job token

When a maintainer reopens an external PR or otherwise triggers this workflow against untrusted PR content, actions/checkout@v5 persists the job's github.token in Git configuration by default. Because this same job grants issues: write and pull-requests: write, Codex can recover a write-capable credential from the checkout even if token-like environment variables are filtered, bypassing the intended least-privilege GITHUB_MCP_TOKEN boundary. Configure checkout with persist-credentials: false and avoid granting write permissions to the unused job token.

Useful? React with 👍 / 👎.