fix: isolate Codex tool discovery from ambient apps

[apresmoi]

Codex enables subscription apps and installed plugins by default, including strict launches that ignore user config. Those ambient capabilities entered the tool-discovery catalog alongside the caller's declared tools.

Every Daimon Codex invocation now disables those two features while preserving its required per-wake MCP server. The argument guard also rejects caller --enable overrides, which Codex applies after ordinary config settings. This establishes capability isolation; it does not claim to eliminate every upstream tool-discovery failure.

Validation:

• Exact Codex 0.142.3 / gpt-5.5 live A/B: ambient app search returned app/plugin tools before the change and no tools afterward; the declared local MCP tool was discovered and executed in both runs.
• 35 targeted tests passed. Removing the isolation flags fails both standalone and strict regression cases; tests exercise a real loopback MCP tool call.
• Typecheck and package build passed. Full macOS suite: 637 passed, four existing Linux-only skips.
• Linux CI passed: https://github.com/noopolis/daimon/actions/runs/34760353935
• Independent cross-vendor review accepted the change with no correctness or robustness findings.