[codex] Fix action pipeline failure handling

[7shep]

Summary

• Enable set -o pipefail in the composite action before piping the CLI report through tee.
• Add a regression test that verifies the action enables pipefail before the tee pipeline.
• Document the failure-propagation requirement in the GitHub Action spec.

Fixes #7

Validation

• npm test
• npm run typecheck
• npm run build