Support the Codex byte proxy for portable App Server connections

[jibanez-staticduo]

Add a transport through the existing Codex CLI's app-server proxy --sock byte relay to the same App Server control socket. Direct Unix-socket transport remains the Unix default; Windows selects the proxy automatically. --transport, --codex-binary, and environment equivalents allow explicit configuration. The bridge does not start or replace the App Server.

Proxy shutdown uses one shared cleanup task protected from caller cancellation. Subsequent closes await that cleanup, including killing and reaping a relay that ignores termination. A missing control socket is reported before spawning the CLI.

Validation

• 130 tests pass, including WebSocket fragmentation/ping, initialization, connection and handshake failure, binary resolution, and cancellation cleanup.
• A real child process that ignores SIGTERM is reaped despite repeated cancellation of close callers. This regression fails on the previous PR revision.
• A lost mutation response through the proxy retains an uncertain receipt; replay does not dispatch again.
• Ruff lint/format, type checks, and source/wheel builds pass.
• Combined with the companion PR: clean merge, 136 tests pass, and lint/format/type/build checks pass.
• Tests ran on Linux with a fake upstream and relay. Actual Windows App Server connectivity remains unverified. No live model session was created.

Independent of #4, which preserves tool provenance and shared callbacks.

[saidelike]

Thank you.