Manage Codex settings at OS scope

[rohita5l]

Summary

• reconcile Codex gateway-critical values into /etc/codex/managed_config.toml during interactive configuration using the shared backup, verification, fingerprint, status, and revert lifecycle from Reconcile Claude OS-managed settings #415
• keep non-interactive runs local-only, while blocking launch when an existing OS-managed value would override ucode
• strictly parse managed TOML, preserve unrelated policy, and keep opt-in smart-routing hooks in the local Codex profile
• remove the obsolete managed-settings scope field and the superseded best-effort managed-file writer
• name Codex and Claude Code together in the single password and success messages when both are selected

Testing

• 574 passed in focused agent, CLI, update, and managed-file tests
• Ruff lint and changed-file format checks passed
• ty checks passed
• 2100 passed, 37 skipped, 4 deselected across non-socket tests; five user-agent socket tests were ignored because this sandbox blocks local socket binding

Stack

• Stacked on Reconcile Claude OS-managed settings #415; review this PR after the Claude managed-settings PR.