Add reliable real Codex E2E coverage

[liaohch3]

Goal

Add end-to-end coverage for the Codex integration without depending on local Claude Code availability.

Scope

• cover real claude-tap + codex execution paths first
• keep this work out of PR chore(github): add focused pull request templates #70 and out of unrelated fixes
• use strong, reliable assertions instead of shallow smoke checks

Minimum expectations

• validate that traces are actually captured, not just that the process exits 0
• assert request input, response output, token usage, and API call count where applicable
• cover both reverse mode and forward mode / fallback behavior if the environment supports it
• verify generated viewer artifacts when the trace should produce them
• keep evidence based on real .traces/ data, not synthetic screenshots

Constraints

• local environment currently does not have Claude Code, so Codex coverage is the immediate priority
• Claude-specific real E2E can remain skipped or follow in a later issue/PR

Suggested test slices

• direct Codex reverse proxy capture with openai_base_url override
• WebSocket incremental request / output reconstruction assertions
• forward proxy with Rust TLS CA env compatibility
• negative assertions for regressions such as API calls: 0, empty input, or missing final output

[liaohch3]

Keeping this open as the tracking issue for real Codex E2E coverage.

Useful acceptance criteria:

• exercise a real Codex CLI run, not only fixture rendering
• keep credentials/network requirements opt-in so fork PRs remain testable
• preserve the current fast unit/fixture tests as the default CI gate
• document exactly how maintainers can run the real E2E locally