#1667 pinned @v1.12 and moved the flaky-relay stream retry tuning from
codex-args into a seeded codex-home config.toml, but the action appends
its own [model_providers.codex-action-responses-proxy] table instead of
merging, so every Codex workflow fails with a TOML duplicate key error.
The overrides cannot be expressed on v1.12 at all.
Pin all three workflows to v1.11, the last release that accepts these
deliberate codex-args overrides under drop-sudo, restoring the original
behavior.
The floating @v1 tag picked up v1.12, whose protected-run validation
rejects model_providers.* overrides passed through codex-args under
drop-sudo, breaking all three Codex workflows. Pin the action to v1.12
and seed a trusted codex-home config.toml with the same settings in an
earlier step instead - the action preserves existing config content.
weishu