chore: prepare final Codex ops foundation PR

[jearonwong]

Summary

• Prepare the final Codex ops foundation PR directly against main.
• Carry forward repo-scoped AGENTS.md, Codex config, reviewer lanes, mirrored skills, goal template, and repo-truth-first script.
• Preserve the three-tier authorization model: normal task-authorized changes, owner-approval-required high-risk changes, and forbidden actions without explicit owner approval.
• Keep .agents/skills as the agent-facing skill mirror and retain .codex/skills as the compatibility/internal copy with mirror equivalence enforced.

Remote Truth / PR Topology

• This is the final PR-to-main surface for the previously stacked Codex ops foundation work.
• Existing stacked PRs are intentionally left open and unmerged.
• No stacked PR was merged as part of this wave.

Validation

• git diff --check origin/main...HEAD
• scripts/codex/repo-truth-first.sh
• wc -c AGENTS.md
• diff -qr .codex/skills .agents/skills
• npm run test
• npm run lint
• npm run docs:build

Forbidden Actions Confirmation

No npm publish, npm deprecate, dist-tag mutation, PyPI mutation, git tag, release seal, package version bump, schema object intake, external registry mutation, product/runtime behavior change, protocol schema change, or public-claim change was performed.