feat(codex): add first-class native routing

[alteixeira20]

Stacked on #223. Please review #223 first.

This draft will be rebased/reconstructed onto the resulting main after #223 merges, then revalidated before being marked Ready.

Problem

Codex should be able to run through PXPipe without losing its native ChatGPT Responses behavior, caller-owned authentication, or native compaction endpoint.

Changes

• add pxpipe codex plus --binary and explicit direct fallback;
• preserve CODEX_HOME and caller-owned ChatGPT authentication;
• resolve persistent Codex model selection read-only from CLI/profile/config;
• route Codex through an isolated /providers/codex/backend-api/codex path on the existing listener;
• preserve the native provider display name OpenAI and Responses wire API;
• leave WebSocket Responses disabled rather than claiming unsupported transport;
• forward /responses/compact byte-for-byte on the authenticated ChatGPT origin;
• add focused launcher, auth, endpoint, and compact-parity tests;
• document the dedicated integration.

Scope

This PR intentionally excludes cache/materiality optimization and Codex-specific history policy. Those are isolated in the next stacked draft.

Validation

The isolated export is one commit on top of the clean provider-router slice.

Fresh clean-head CI passed:

• production dependency audit;
• TypeScript typecheck;
• full test suite;
• build.

Because this is temporarily stacked against upstream main, GitHub may show #223's router changes until #223 merges and this branch is rebuilt on the new upstream base.