spawn: launch codex through the bundled monitor shim, and refuse a bare fallback

[fujibee]

Summary

Refs #1063.

• spawn.sh launches a Codex seat through the bundled monitor shim instead of the bare codex binary. The shim is installed on purpose as an interactive-shell function (Prefer shell function setup for Codex monitor shim #193), which a non-interactive boot script cannot see, so command -v codex there resolved the real binary and the seat started without --remote; the bridge then retried against a thread it could not own, every few seconds, and the seat never received a message.
• A type declares the wrapper in its manifest — spawn_wrapper=codex-shim.sh in codex/type.conf, relative to the type's driver directory — and spawn resolves it through agmsg_type_dir to a bundled absolute path. No PATH or function lookup is involved, which is how the bypass happened. The cli= existence check is kept: the shim needs the real binary too.
• A declared wrapper that is missing or not executable is a spawn failure, never a fallback to the bare CLI. The symptom this closes is "a seat that looks spawned and never says a word", so any path that silently launches the bare binary would reproduce it.
• The boot script clears the codex shim stack's whole runtime-control namespace before the wrapper runs, through the manifest's existing spawn_unset_env list (Same-type agmsg spawn (claude-code → claude-code) inherits the parent's session-identity env vars, breaks auth #294's mechanism), which now accepts a namespace entry: AGMSG_CODEX_* is enumerated from env at boot time and every match is unset, plus the two names outside it, AGMSG_REAL_CODEX and CODEX_THREAD_ID. Two of those controls are exported by the stack itself in normal operation, so inheritance is the ordinary case: codex-monitor exports AGMSG_CODEX_BRIDGE=1 just before exec'ing the bridged TUI (inherited, the shim execs the real binary at once), and the installed PATH wrapper exports AGMSG_CODEX_SHIM_WRAPPER=1 / AGMSG_CODEX_SHIM_SCRIPT_DIR (inherited, the bundled shim takes the parent's install dir, and a stale one reads as "not a monitor project"). Both fire ahead of any guard inside codex-monitor — found in review, one name per round, which is why the rule is a namespace rather than a list. Control flow of the generated script, in order: cd into the project; export AGMSG_SPAWNED=1; the namespace loop and the literal unset; run the wrapper.
• The set was derived from both sides and the verdict per name is recorded in codex/type.conf: readers are every $VAR / ${VAR in the stack's bash files (shim, monitor, _app-server.sh, bridge launcher, codex-record-session.sh, _session-start.sh, codex-shim-install.sh, _delivery.sh) and every process.env.VAR in codex-bridge.js, for AGMSG_* and CODEX_*; writers are the stack's export lines, the command-local AGMSG_REAL_CODEX the shim hands to codex-monitor, and the generated wrapper. Cleared: the 19 AGMSG_CODEX_* names in use today, AGMSG_REAL_CODEX, CODEX_THREAD_ID. Kept, each with its reason: AGMSG_SPAWNED (the seat's own marker), agmsg-wide configuration (AGMSG_BASH, AGMSG_WATCH_ONCE_*), bats-only hooks, and names that are script-local variables rather than environment inputs.
• A full allow-list (running the boot under env -i) was considered and rejected: the CLI needs the user's own auth, PATH, HOME, locale and terminal, which spawn cannot enumerate per CLI version, so a miss there breaks every spawn. A miss in the namespace rule — a control variable added outside AGMSG_CODEX_* — is caught at review time by the reader-inventory test below; if the rule were bypassed at runtime the symptom would be the original one, a seat that looks spawned and never speaks.
• codex-monitor.sh's fail-open (exec_plain_codex, the internal fallback when the app-server cannot start) now fails closed when AGMSG_SPAWNED=1 — the marker every spawn boot script already exports. Fail-open exists for a person at the keyboard who reads the banner and keeps a working Codex; a spawned seat has nobody at its pane, and a plain Codex there is the same silent seat. The person's path is unchanged (its test is the control).

Not changed

• The shim's own passthrough when the project's Codex delivery mode is not monitor/both is a configured state, not the bypass, and is left as is.
• The exec … --remote lines that fix(codex): open the TUI on the role's recorded thread, and let the bridge attach to it #960 (thread affinity) rewrites are not touched; this change lives in exec_plain_codex and in spawn.

Verification

• tests/test_spawn.bats: the boot script's CLI line starts with <skill>/scripts/drivers/types/codex/codex-shim.sh (read from the script, first non-assignment token) and contains no bare codex launch; making the shim non-executable turns spawn into a refusal that names the wrapper, and no boot script reaches the terminal; claude-code still launches bare claude; and end to end, running the boot script spawn wrote — with a fake codex on PATH that records its argv and serves a fake app-server, the project in monitor mode, and a stub bridge launcher — reaches the real binary exactly once, as codex --remote ws://127.0.0.1:<port> … actas ….
• tests/test_spawn.bats, inherited state — each seeded into the parent environment and the argv that reaches the real binary read back: the bridge family (AGMSG_CODEX_BRIDGE=1 + app-server/launcher markers + a parent CODEX_THREAD_ID); AGMSG_CODEX_SHIM_DISABLE=1 alone; the installed-wrapper pair with a stale AGMSG_CODEX_SHIM_SCRIPT_DIR (no delivery.sh there); and the resolution overrides (AGMSG_REAL_CODEX, AGMSG_CODEX_MONITOR_CMD, launcher/bridge commands) pointing at nonexistent paths. The namespace loop and the literal unset are asserted to precede the wrapper line.
• tests/test_spawn.bats, unknown names: a control that does not exist yet (AGMSG_CODEX_FUTURE_KNOB=1) is absent from the environment the real binary receives, while an ordinary variable and AGMSG_SPAWNED survive; replacing the namespace entry with today's explicit list turns exactly this test red. A reader-inventory test derives the stack's AGMSG_*/CODEX_* reads the same way as above and fails on any name not covered by the manifest or the reasoned keep list.
• tests/test_codex_monitor.bats: with AGMSG_SPAWNED=1 and an app-server that will not start, codex-monitor exits non-zero, starts no plain Codex, and says why; the identical failure without the marker still fails open (control).
• Existing assertions on the codex boot line updated to the wrapper form (codex-shim.sh resume <uuid>, codex-shim.sh -m gpt-5).
• bats tests/test_codex_monitor.bats 12/12, tests/test_codex_shim.bats 25/25, tests/test_spawn.bats 99/99 (full suite at the final head, run detached on a loaded host); .github/scripts/check-enforced-assertions.sh and check-errexit-status-reads.sh at baseline; bash -n on the touched scripts.