Triage: feat: support Codex ChatGPT OAuth auth

[time-attack]

Tracking the change proposed in #126 (by @eddie333016).

We're moving this from a code PR to a tracked issue under CONTRIBUTING.md: feature ideas belong in adrs/ as a short human-written note and bugs as an issue, and we implement the underlying code from our side. Capturing the original proposal here so it isn't lost.

Original PR: #126
Reported by: @eddie333016

---

Summary

• Add first-class Codex ChatGPT OAuth auth-file discovery and isolated child authentication.
• Verify provider-signed OAuth JWT rotations while refusing to persist unverified opaque access or refresh replacements.
• Keep OAuth separate from generic OpenAI credentials while hardening JSON-RPC validation, diagnostics redaction, runtime cleanup, and durable-record cancellation.

Validation

• Affected Codex/dev/model suite: 80 passed, 0 failed.
• TypeScript typecheck: passed.
• ESLint: passed.
• Oxlint: passed.
• Prettier format check: passed.
• Knip: passed.
• Live installed Codex OAuth smoke: exact reply marker QM_OAUTH_FINAL_420AFB8; model calls completed with nonzero usage, the child received no ambient API key, base URL, or Codex access token, and the auth lock was cleared.
• Full suite: 3,739 tests, 3,603 passed, 4 failed, 132 skipped. The four failures are Gmail MIME tests requiring Python 3.10 union syntax while this host provides Python 3.9.6; they do not involve OAuth changes.
• Slack/browser QA is intentionally deferred; Slack setup is not required for Codex OAuth.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

If we ship a fix or feature from this, credit @eddie333016 as co-author.