Fallback on non-quota Codex exec failures

[Pigbibi]

Summary

• keep quota/capacity classification for Codex exec failures
• treat other Codex process nonzero output as unknown so provider=auto can use API fallback
• keep service auth/allowlist classification outside Codex exec output

Tests

• python3 -m ruff check scripts/run_monthly_codex_audit.py scripts/codex_audit_service.py service/ai_gateway_service.py tests/test_run_monthly_codex_audit.py
• python3 -m unittest tests.test_run_monthly_codex_audit.RunMonthlyCodexAuditTests.test_service_failure_classification_identifies_infra_failures tests.test_run_monthly_codex_audit.RunMonthlyCodexAuditTests.test_service_failure_classification_ignores_source_code_secret_words
• python3 -m unittest discover -s tests
• git diff --check

[github-actions]

🤖 Codex PR Review

⚠️ Review skipped: The Codex review could not be completed.

Codex service request failed: 401 {"error": "OIDC workflow_ref is not allowed"}

Please ensure a human reviewer checks this PR before merging.