[fix](ci) Generate local review context and randomize Codex auth

[zclllyybb]

What problem does this PR solve?

Issue Number: None

Related PR: #65178

The review runner previously obtained the aggregate pull-request diff through the GitHub API. GitHub rejects aggregate diffs larger than 20,000 lines, causing large pull requests to fail before Codex could review them. The runner now checks out complete history and locally generates the changed-file list and the verified three-dot diff from the live base and head SHAs. The review prompt also states those diff semantics, and context-preparation failures are reported separately from Codex failures.

Each run now randomly selects oss://doris-community-ci/codex/auth.json.1 or oss://doris-community-ci/codex/auth.json.2, downloads it locally as auth.json, and syncs refreshed credentials back to that same selected object.

Release note

None

Check List (For Author)

• Test: git diff --check upstream/master...HEAD
• Test: Fork workflow run on a recreated 280-file PR (+26,082/-452), completed review successfully.
• Test: Fork workflow run on a small PR, completed review successfully; selected auth.json.1 and uploaded refreshed credentials back to auth.json.1.
• Behavior changed: Yes
• Does this need documentation: No

[hello-stephen]

Thank you for your contribution to Apache Doris.
Don't know what should be done next? See How to process your PR.

Please clearly describe your PR:

1. What problem was fixed (it's best to include specific error reporting information). How it was fixed.
2. Which behaviors were modified. What was the previous behavior, what is it now, why was it modified, and what possible impacts might there be.
3. What features were added. Why was this function added?
4. Which code was refactored and why was this part of the code refactored?
5. Which functions were optimized and what is the difference before and after the optimization?

[zclllyybb]

run buildall

[zclllyybb]

/review

[github-actions]

I found one workflow correctness issue in the new failure-reporting path. The local diff/context generation and Codex auth randomization paths otherwise look coherent from static review: checkout verifies the requested head, context generation uses the verified three-dot range, auth sync writes back to the selected object, and the prompt accurately documents the merge-base-to-head diff semantics.

Critical checkpoint conclusions:

• Goal/test coverage: the PR addresses large-diff review context generation and auth-object contention; the author reports fork workflow coverage, but I did not run workflows from this review environment.
• Scope/focus: the change is focused to the review runner workflow.
• Concurrency/lifecycle: no runtime concurrency in Doris code; the CI auth-object split reduces shared-token contention, with sync-back tied to the selected object.
• Compatibility/parallel paths: failure reporting has a skipped-step edge case called out inline; review-context and Codex failure paths were otherwise traced.
• User focus: no additional user-provided review focus was supplied.

ok

[github-actions]

PR approved by at least one committer and no changes requested.

[github-actions]

PR approved by anyone and no changes requested.