Fix Codex notify hook placement in config.toml

[ZenithalHourlyRate]

Summary

This fixes agent-notify --setup-codex so it writes the notify hook at the TOML root instead of appending it after the last table.

The current implementation appends:

notify = ["/path/to/agent-notify"]

If ~/.codex/config.toml already ends in a table such as [tui], TOML interprets that as [tui].notify, so Codex never sees the top-level notify hook.

Changes

• detect whether a root-level notify = ... entry already exists before the first table
• prepend the hook when it is missing, so it lands at the TOML root
• add a regression test covering a config that already contains [tui]
• run that regression test in CI alongside shellcheck

Validation

• bash tests/setup-codex.sh

Closes #1.