[codex] Add Multica read-only client

[yujiezhang-ops]

What changed

• Added src/multica-client.js with createMulticaClient and read-only methods for issue, agent, runtime, and agent skills.
• Normalizes all successful responses into the agreed fail-closed envelope and safe data shapes.
• Reuses SECRET_ENV_PATTERNS from launch-review.js and only returns env key names plus detected secret key names.
• Added node:test coverage for happy path, missing-field degradation, invalid JSON, non-zero CLI exit, and env value redaction.

Validation

• npm test (9/9 pass)