Mostly small quality-of-life fixes in this release.
## Highlights
Updated the npm release process to use ["trusted publishing"](https://docs.npmjs.com/trusted-publishers) (#3431). Though apparently there was a bug, so we may not see the benefit until `0.38.0`. Fix is in #3806.
## Merged PRs
- [#3329] notifications on approvals and turn end (#3329)
- [#3659] chore: restore prerelease logic in rust-release.yml (#3659)
- [#3617] chore(deps): bump serde_json from 1.0.143 to 1.0.145 in /codex-rs (#3617)
- [#3664] chore: simplify dep so serde=1 in Cargo.toml (#3664)
- [#3618] chore(deps): bump serde from 1.0.219 to 1.0.223 in /codex-rs (#3618)
- [#3619] chore(deps): bump wildmatch from 2.4.0 to 2.5.0 in /codex-rs (#3619)
- [45bccd36](https://github.com/openai/codex/commit/45bccd36b038a28b23663189cc6f7557e49e06d0) fix permissions alignment
- [#3673] fix: read-only escalations (#3673)
- [#3680] Update azure model provider example (#3680)
- [#3745] Persist search items (#3745)
- [#3678] fix: Record EnvironmentContext in SendUserTurn (#3678)
- [#3701] Review mode core updates (#3701)
- [#3755] restyle thinking outputs (#3755)
- [#3758] Add dev message upon review out (#3758)
- [#3431] fix: make GitHub Action publish to npm using trusted publishing (#3431)
- [#3763] fix: ensure pnpm is installed before running `npm install` (#3763)
- [#3767] fix: make publish-npm its own job with specific permissions (#3767)
- [#3806] fix: specify --repo when calling gh (#3806)