fix: complete Codex provider support

[dollspace-gay]

Summary

• keep all bundled rule Markdown files registered and zero-byte while removing fallback injected prose
• normalize autonomous launch policy across kickoff, plan, swarm, sentinel, and container boundaries
• enforce normal provider account login for container agent launches and add isolated credential-volume smoke coverage
• keep canonical Codex plugin assets synchronized and update provider-neutral documentation
• reduce Windows CI from the full 2,933-test binary suite to 385 platform/provider tests plus all 201 CLI integrations; Linux retains the full suite and macOS retains its full non-property suite

Local verification

• strict cargo fmt and Clippy
• 2,933 Rust binary tests
• 201 CLI integration tests
• 16 provider hook fixture tests
• 103 dashboard tests plus dashboard build/lint
• VS Code extension compile/lint
• Cargo audit with the repository allowlist
• docs render, artifact verification, and link lint
• Codex plugin generation, manifest validation, installation, 18 skills, and two MCP servers
• rootless Podman image build with Claude and Codex CLI, non-root dispatch, login refusal, isolated persistent volumes, removal, and secret-surface checks
• installed release wrapper SHA matched the build artifact
• fresh local-only Git repository initialized both integrations; live Codex kickoff used native web search, emitted JSONL/web/file/usage events, committed one file, closed its issue, ended its session, and reached DONE

Safety

• no API-key authentication or forwarding
• no safe-fetch downloader or second page retrieval
• no merge requested