[codex] pin dependencies and stabilize CI

[QuentinCody]

Summary

• Pin direct dependency specs to the exact versions already resolved in the lockfile.
• Give the slow verify suppression integration test enough time under CI load.
• Fix secret-token regex boundaries for token alphabets that can validly end with -.

Validation

• npm run typecheck
• npm run typecheck:stable
• npm run docs:check
• CI=1 npm test
• npm run build
• npx publint
• npx --package=@arethetypeswrong/cli attw --pack . --profile esm-only
• npm pack --dry-run
• tarball install smoke test
• INTERLINKED_REPO_URL=/Users/quentincody/interlinked-cli INTERLINKED_REPO_REF=HEAD bash scripts/smoke-onboarding.sh