Base-branch review prompt can use a stale merge-base SHA

Summary

Base-branch review prompts currently embed a merge-base SHA that is computed before the review turn. If the prompt is reused after the checkout or refs change, the reviewer can diff against a stale commit and inspect the wrong changes.

Why this matters

The generated review instructions can tell Codex to run git diff <old-sha>. That SHA may no longer be the correct merge base for the branch/ref being reviewed by the time the agent starts work.

Example:

1. A review prompt for origin/main is created while feature-a is checked out, and the merge base is aaa111.
2. The user switches to feature-b, where the correct merge base is bbb222.
3. If the stale prompt still says to use aaa111, the review compares the wrong range.
4. The reviewer may report unrelated findings or miss the actual changes under review.

Expected behavior

For base-branch reviews, the prompt should ask the agent to compute the merge base during the review turn, for example:

MERGE_BASE=$(git merge-base HEAD "<base>")
git diff "$MERGE_BASE"

This keeps the diff tied to the checkout and refs that are live when the agent actually reviews the code.

Candidate fix

I prepared a small candidate change that removes the precomputed SHA from the prompt and defers merge-base computation to review time:

https://github.com/mhemmings/codex/tree/codex/fresh-review-merge-base

The candidate branch also removes the now-unused prompt crate dependency on codex-git-utils and updates the related prompt/core tests.

Validation run on candidate branch

• Self-review cycle 1: quoted the base ref in the generated shell command.
• Self-review cycle 2: simplified the core review test.
• Self-review cycle 3: no further changes to make.
• just fmt
• CARGO_NET_GIT_FETCH_WITH_CLI=true just test -p codex-prompts
• CARGO_NET_GIT_FETCH_WITH_CLI=true just test -p codex-core review_base_branch_prompt_computes_merge_base_at_turn_time
• git diff --check