[codex] Fix smoke auth and Python test docs

[clawdbot502]

Summary

• Send AGENT_API_TOKEN from npm run smoke, matching the other validation scripts when RBAC is enabled.
• Add a regression assertion covering smoke script token support.
• Clarify that local Runtime unit tests should use Python 3.11-3.13 because the pinned Python dependencies do not currently support Python 3.14.

Validation

• npm run typecheck
• npm run build
• npm run test:auth
• npm run test:python

Notes

• Full Docker smoke could not be run in this environment because Docker Hub access to registry-1.docker.io:443 timed out while pulling pgvector/pgvector:pg16.