feat: make bundled Codex runtime authoritative

[baron]

Summary

• make the verified bundled Codex runtime authoritative for app-server and exec launches
• support only an explicit absolute REPOPROMPT_CODEX_EXECUTABLE override, gated to the 0.144.6 app-server contract floor
• isolate RepoPrompt-managed Codex config, auth, and SQLite state while preserving the direct-only RepoPrompt MCP namespace policy
• resolve one runtime/environment snapshot through native MCP provisioning and process launch
• avoid redundant provisioning and repeated serialized failed version probes
• fail closed without mutating ambiguous dotted or inline Code Mode TOML
• redact external runtime paths from exported connection diagnostics

Why

PR2 bundled a pinned Codex runtime. This PR makes that runtime the application authority so user PATH drift, stale global CLIs, and mismatched config/state no longer silently influence RepoPrompt sessions. Explicit external overrides remain available for advanced testing but must satisfy the same app-server contract.

Reliability and performance

• app-server and exec paths use the same runtime-selection rules and managed CODEX_HOME / CODEX_SQLITE_HOME
• native Agent Mode passes the exact selected runtime through MCP provisioning and launch
• invalid override probes do not hold the global cache lock and identity-bound failures are cached briefly
• non-agent clients no longer provision Codex configuration twice
• conflicting Code Mode TOML is rejected byte-identically instead of risking invalid config

Validation

• CodexRuntimeAuthorityTests: 7/7 passed
• CodexIntegrationConfigurationTests: 22/22 passed
• CodexMCPBootstrapReadinessTests: 3/3 passed
• managed-runtime guidance regression: 1/1 passed
• make dev-lint: passed
• make dev-swift-build PRODUCT=all: passed for RepoPrompt and repoprompt-mcp
• commit and push contribution preflights: passed

Full-suite note

The one-hour root swift test lane timed out after 3600 seconds with failures in unrelated Codemap, ContextBuilder, and durable-artifact timing/concurrency tests. Every Codex suite reached by that run passed, including all PR-specific suites above. No unrelated test code was changed to mask the baseline failures.

Architecture

This preserves the existing one app-server process per tab/session model. It does not introduce a shared app-server process or a Codex source fork.