[codex] Fix release-hold auth and timestamp parsing

[jleni]

What changed

• export GH_TOKEN to the composite step so gh commands authenticate in GitHub Actions
• replace GNU-only date -d timestamp parsing with a portable Python-based ISO-8601 conversion

Why

The new release-hold action had two portability issues:

• gh was invoked without an auth token, which can fail in CI and private repositories
• date -d only works on GNU date, so the action would fail on macOS runners

Impact

• release-hold now works with authenticated gh calls by default in GitHub Actions
• timestamp parsing is portable across GitHub-hosted runners that provide Python

Validation

• parsed release-hold/action.yml successfully with Ruby YAML
• verified the Python timestamp conversion works with a sample ISO-8601 timestamp
• reviewed the resulting git diff for the targeted fix scope