refactor(ci): add shared ci success

[jbeckwith-oai]

Update the existing Promptfoo Code Scan workflow so it reruns on synchronize and reopened pull request events, and add a CI Success job that uses the shared first-party action from promptfoo/.github. This keeps the current security scan job intact while giving the repo a single required status check path. Test plan: verify the updated workflow parses and CI Success waits for the security scan on PRs.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e4e40b8bd4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Pin ci-success action to an immutable revision

Avoid referencing promptfoo/.github/.github/actions/ci-success with @main. A mutable branch means any future upstream change (or compromise) can silently alter this repo’s CI behavior and required-check outcome. This is a supply-chain integrity risk in the workflow itself; pin to a full commit SHA (or another immutable ref) and update deliberately.

Useful? React with 👍 / 👎.