docs(cli): scope Codex token injection (avoid shell-profile export)

.github/workflows/release.yml

@@ -67,6 +67,14 @@ jobs:
   bump-dev-version:
     needs: publish
     if: ${{ inputs.dry-run != true }}
+    # A reusable-workflow CALL cannot grant the callee more than the calling job holds,
+    # and GitHub refuses the whole run at startup when the called workflow's own job
+    # declares permissions the caller did not pass down ("startup_failure", runs
+    # 33615174183 / 33615177849 — the first dispatches since #3129 wired this call).
+    # The callee's job declares exactly these two; nothing else in this file gains them.
+    permissions:
+      contents: write
+      pull-requests: write
     uses: ./.github/workflows/dev-version-bump.yml
     with:
       released-version: v${{ inputs.version }}

docs-site/src/content/docs/reference/cli/lifecycle.md

@@ -430,10 +430,15 @@ What does carry the token into a Codex process:
 
 - the shim installed by `ocx codex-shim install` (reads the token file at launch; the supported path
   for Codex started from shells, Desktop, cron, or another service);
-- exporting `OPENCODEX_API_AUTH_TOKEN` yourself in the process that starts Codex — a shell profile,
-  the cron line, or an `Environment=`/`EnvironmentFile=` on the systemd unit that launches
-  **Codex** (not the proxy). Point it at the existing token file; do not copy the value into
-  `config.toml`.
+- a dedicated launcher that reads the protected file, exports `OPENCODEX_API_AUTH_TOKEN`, and
+  immediately executes Codex. Keep that export command-scoped (for example, in the cron command or
+  an `ExecStart=` wrapper for the systemd unit that launches **Codex**, not the proxy).
+
+Never export this token from a shell profile: every unrelated process launched from that shell would
+inherit a reusable data-plane credential. The token file contains only the raw value, not the
+`NAME=value` syntax required by systemd's `EnvironmentFile=`, so do not point `EnvironmentFile=` at
+it. Prefer the shim; if you build a dedicated launcher, preserve the file's owner-only access and do
+not copy the value into `config.toml` or a service definition.
 
 What does not: an `EnvironmentFile=` or `OCX_API_TOKEN_FILE` on `opencodex-proxy.service`. Those
 configure the proxy process only and never flow into an independently launched `codex exec`.