fix: allow omitted permission helper flags

[acomarcho]

Why

PR #113 made the public sandbox and permission-profile action inputs optional with empty-string defaults. The downstream runCodexExec code already treats empty values as omitted and falls back to the legacy workspace-write sandbox when neither input is set.

The helper CLI still used Commander requiredOption() for both flags, so callers that omit either helper flag fail before that existing fallback logic runs. This can break existing CI even though the public action contract says both inputs are optional.

What changed

• Make the internal run-codex-exec helper options --sandbox and --permission-profile optional with "" defaults.
• Keep the existing behavior after parsing: empty sandbox/profile values still normalize to null; neither input still resolves to --sandbox workspace-write; real sandbox plus real permission-profile is still rejected.
• Add regression coverage for omitted sandbox, omitted permission-profile, both omitted, and profile selection with either an empty or omitted sandbox flag.
• Rebuild the checked-in dist/main.js bundle.

Testing

• corepack pnpm test
• corepack pnpm run check
• git diff --check

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[acomarcho]

I have read the CLA Document and I hereby sign the CLA