Restore Codex subscription auth handshake

[m-mohamed]

Summary

• log the Codex app-server into ChatGPT subscription auth after initialization
• service app-server token refresh requests through the central auth store
• re-authenticate shared runtimes when the access token rotates while keeping child auth files refresh-token-free

Regression

A sanitized auth.json alone does not establish the app-server bearer session, so subscription-backed turns can fail with 401 Unauthorized: Missing Bearer.

Verification

• regression test first reproduced the 401 before the implementation
• node --experimental-test-module-mocks --test test/codex-auth-store.test.ts test/codex-harness.test.ts (50/50)
• npm run typecheck
• npm run lint -- --quiet
• npm run format:check -- src/harness/codex-auth-store.ts src/harness/codex-harness.ts test/codex-auth-store.test.ts test/codex-harness.test.ts

The child process still receives only sanitized OAuth material; the refresh token remains owned by the central store.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}