ci: reject multi-line Codex auth secret

[DaleSeo]

Motivation and Context

GitHub masks each line of a multi-line secret separately. When auth.json is saved as codex login writes it, with pretty-printing, lines like { and } get masked. As a result, GitHub drops the classification job output with a message saying, "Skip output 'classification' since it may contain secret." Then Apply labels is silently skipped, even though the run reports success.

This check makes the failure visible and tells maintainers how to reset the secret: jq -c . auth.json | gh secret set CODEX_AUTH_JSON. A single trailing newline from jq -c is still accepted.

How Has This Been Tested?

Breaking Changes

CI-only change.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed