feat(profile): add Codex profile adapter

[christso]

Summary

• add an isolated CODEX_HOME profile adapter with a fail-closed named TOML launcher
• add Codex 0.149 native marketplace/plugin lifecycle support, authoritative identity checks, and conservative ownership handling
• translate strict settings and portable MCP environment references without materializing secret values
• report disabled native plugins as drift while preserving unowned resources and cleaning up managed disabled resources

Validation

• bun test — 1,706 passed, 6 skipped
• bun run test:e2e — 142 passed, 4 skipped
• bun run typecheck
• bun run lint
• bun run build
• cd docs && bun run build
• final reviewer: no remaining P0-P2 findings

Real runtime dogfood

Using Codex CLI 0.149.0 and the built dist/index.js:

1. Created an isolated temporary HOME with a global codex-dogfood profile, local native marketplace/plugin, file skill, named settings, and MCP server using ${DOGFOOD_TOKEN}.
2. Ran profile install codex-dogfood --dry-run --yes; verified no profile root or launcher was created.
3. Ran profile install codex-dogfood --yes; verified native plugin 1.0.0, named TOML, MCP env_vars = ["DOGFOOD_TOKEN"], and no secret value on disk.
4. Ran the generated launcher with real authenticated codex exec --strict-config --ephemeral; Codex observed both native-skill and profile-only, plus distinct PROJECT_A_ONLY / PROJECT_B_ONLY instructions from each working directory.
5. Changed settings and native plugin version, then ran update --profile codex-dogfood; verified settings changed and the native plugin refreshed to 1.0.1 while both project hashes stayed unchanged.
6. Ran profile status codex-dogfood; every managed resource was unchanged.
7. Ran profile remove codex-dogfood --yes; verified the owned root/launcher disappeared, source marketplace and projects remained, and ambient Codex plugin inventory stayed empty.
8. Removed the complete temporary fixture, including temporary isolated authentication state.

Related: #460

[cloudflare-workers-and-pages]

Deploying allagents with    Cloudflare Pages

Latest commit:	bea213e
Status:	✅  Deploy successful!
Preview URL:	https://27e2d519.allagents.pages.dev
Branch Preview URL:	https://feat-460-codex-profile.allagents.pages.dev

View logs