install.sh installs into writable versioned Homebrew Cellar path when codex is already on PATH

[OpenCodeEngineer]

What happened

Running ./install.sh on a machine where command -v codex already resolves to a writable Homebrew Cellar path installs the new binary back into that Cellar directory.

Observed on March 26, 2026:

• command -v codex resolved to /opt/homebrew/Cellar/node/24.7.0/bin/codex
• ./install.sh completed successfully
• installer output ended with Installed: /opt/homebrew/Cellar/node/24.7.0/bin/codex

This currently follows the script logic:

elif [ -n "$resolved_codex" ] && [ -w "$(dirname -- "$resolved_codex")" ]; then
    dest_dir=$(dirname -- "$resolved_codex")
else
    dest_dir="$HOME/.cargo/bin"
fi

Why this is a problem

• Homebrew Cellar paths are versioned and can disappear on package upgrades.
• A writable resolved codex path is not necessarily a safe install target.
• In the worst case this can overwrite an unrelated codex binary if the name collides.

Reproduction

1. Ensure codex on PATH resolves to a writable versioned Cellar path.
2. Run ./install.sh from the repo root.
3. Observe that the installer copies the new binary into that Cellar directory instead of a stable user-owned install location such as ~/.cargo/bin.

Expected behavior

install.sh should prefer a stable user-owned destination by default, or at least reject versioned package-manager Cellar locations as install targets unless the user explicitly opts in.

Additional information

The build/install itself succeeded; the issue is destination selection, not compilation failure.