fix(codex): reject unmanaged account auth homes

[hbrodin]

Summary

• reject a non-empty CODEX_HOME when coop's managed guest config selects ChatGPT keyring auth
• serialize the coop-managed credential-store setting as an exact first-line invariant shared by the host guard and guest wrapper
• cover alternate-home rejection, the normal unset-home path, nested TOML decoys, and multiline TOML values
• document the unsupported override and fail-closed behavior

Root cause

CODEX_HOME is forwarded only into the interactive SSH session, while the host-side preflight runs in a separate bare SSH command. The preflight therefore validated ~/.codex/config.toml, but the wrapper could read an alternate config and fall through to plain Codex, allowing codex login to write a plaintext auth.json outside coop's cleanup path. A line-oriented key search also could not distinguish a root TOML setting from a nested key.

The managed config now carries a canonical first-line keyring setting. Both guards validate that same structural marker, and the wrapper rejects CODEX_HOME before inspecting the alternate config.

Closes #441.

Testing

• prek run --all-files
• cargo test --workspace (1,116 coop tests and 39 proxy tests)
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo deny --workspace check
• bash -n scripts/guest/codex-account.sh tests/integration.sh
• focused Codex account-wrapper and config-serialization regression tests

Not run: VM integration on Firecracker or Lima. This Linux environment has no /dev/kvm or Firecracker tooling, is not a macOS/Lima host, and no remote integration target was available.