feat: add guided Codex CLI dry-run backend

[IshaanAyaan]

What this adds

• a guided leftovers setup codex wizard that validates prerequisites and writes an owner-only dry-run configuration
• a first-party Codex CLI backend with controller-owned arguments, strict stage schemas, isolated process state, exact usage telemetry, and fail-closed checks
• operator documentation, security guidance, continuity notes, and regression coverage

Safety boundaries

• no GitHub, OpenAI API, SSH, cloud, or ambient host credentials are passed into worker commands
• Codex runs ephemerally with approval disabled, network disabled, minimal permission profiles, ignored repository rules, and rejected repository-local skill injection
• this backend is intentionally execute-only: draft-pr publication remains blocked until an OCI-backed publisher path can preserve the existing credential boundary
• setup never installs host packages, logs in, builds an image, schedules jobs, or enables publication

Verification

• PYTHONPATH=src python3 -m unittest discover -s tests -v: 180 passed, 1 skipped (OCI runtime unavailable)
• Python compilation and git diff --cached --check: passed
• example configuration validation, fixture scouting, and process-mode training rehearsal: passed
• installed Codex CLI version, ChatGPT login, bundled gpt-5.6-luna availability, and generated argument parsing: passed

Docker/Podman and Ruff are not installed on this host, so package smoke and release-quality OCI rehearsal were not run. No live model request was made and no subscription quota was consumed during verification.