fix: prompt.md via stdin now combines with codex flags

Options like -s read-only routed execution into the /dev/null branch,
so codex got no prompt at all. codex natively appends piped stdin as
a <stdin> block, so feeding prompt.md unconditionally is safe.

scripts/codex-run.sh

@@ -6,7 +6,8 @@
 #   codex-run.sh <job_dir> resume <thread_id> [codex-flags...] [prompt]
 #   codex-run.sh <job_dir> review [--base X|--commit Y|--uncommitted] [codex-flags...] [prompt]
 #
-# If <job_dir>/prompt.md exists and no positional prompt given, it is fed via stdin.
+# If <job_dir>/prompt.md is non-empty it is always fed via stdin ('-'); codex-flags
+# stay positional, so options and a file prompt combine freely.
 # Review runs against the git repo at the CURRENT WORKING DIRECTORY (no -C support).
 #
 # Files written to <job_dir>: events.jsonl last.md err.log thread_id status
@@ -36,7 +37,7 @@ esac
 
 rm -f "$JOB_DIR/status" "$LAST"; : > "$EV"; : > "$ERR"
 
-if [[ $# -eq 0 && -s $JOB_DIR/prompt.md ]]; then
+if [[ -s $JOB_DIR/prompt.md ]]; then
   "${CMD[@]}" - < "$JOB_DIR/prompt.md" > "$EV" 2> "$ERR" &
 else
   "${CMD[@]}" "$@" < /dev/null > "$EV" 2> "$ERR" &