[codex] Apply audit remediation

[Pigbibi]

Summary

• apply the 2026-06-10 audit remediation items
• tighten GitHub workflow permissions, job timeouts, and scheduled/manual concurrency where applicable
• add focused characterization or governance checks where this repository has runtime-facing changes

Validation

• targeted local tests and lint checks were run before publishing
• workflow governance scan passed across the remediation scope
• git diff --check passed across the remediation scope

See local audit report: QuantStrategyLab-review-2026-06-10.md.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 193993d312

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Include target in workflow concurrency group

This new workflow-level group collapses every Deploy and Keep Active run on the same ref into a single concurrency bucket before select-targets reads the workflow_dispatch target, even though the deploy job still has per-target concurrency (ibkr-gateway-${{ matrix.target.name }}). Because GitHub concurrency keeps at most one running and one pending run per group and replaces older pending runs, a running scheduled/all deploy followed by manual dispatches for two different targets can cancel the first pending target deploy even though those targets are independent. Include the selected target in the group for manual runs or rely on the existing per-target job concurrency.

Useful? React with 👍 / 👎.