Add explicit Codex trace capture

[fengjikui]

Summary

• Add explicit single-session Codex Desktop/CLI rollout observation without copying historical rollout text into peekMyAgent SQLite.
• Add opt-in exact HTTP Responses capture for one managed Codex process, with first-party route allowlisting, zstd-safe forwarding, header redaction, and OpenAI Responses normalization.
• Separate Claude Code, Codex, OpenClaw, and imported traces in Viewer navigation.
• Add Codex-aware request, response, tool-loop, translation, provenance, persistence, and Viewer contracts.
• Document product boundaries, architecture, upstream evidence, and manual integration coverage.

Validation

• Focused Codex rollout, exact proxy, Viewer, wrapper, normalization, persistence, navigation, translation, and i18n smokes passed.
• npm run release:check:macos passed locally with 100+ checks.
• Hosted release matrix passed on macOS, Windows, and Linux: https://github.com/fengjikui/peekMyAgent/actions/runs/29634137706
• A real isolated Codex tool loop completed through exact capture: model tool call -> local shell result -> final assistant response.
• Package dry-run excludes private traces, credentials, local evidence bundles, and screenshots.

Capture Boundary

• pma codex --select stores only the selected thread id; rollout content remains in Codex-owned local files and is read on demand.
• pma codex capture -- [codex args...] affects only the child Codex process launched by that command.
• Exact capture forwards only verified first-party Codex routes and does not modify ~/.codex/config.toml.
• Sensitive authentication and Codex correlation headers are forwarded to the real upstream but redacted from saved captures.
• Local observation can be cleared with pma codex --clear; exact capture ends when the managed child process exits.