feat(codex): bundle Codex CLI with CSGClaw

[GatewayJ]

Summary

• Bundle the matching Codex CLI into CLI, Desktop backend, and Docker release artifacts.
• Resolve Codex only from the real CSGClaw bundle directory; a host Codex beside a launcher symlink cannot override it.
• Reject upgrade bundles whose required Codex binary is not executable, while retaining Windows .exe handling.
• Remove the obsolete Windows .cmd/.bat shim path and launch the bundled native executable directly.

Validation

• Targeted Go tests for Codex, upgrade, runtime wiring, Codex runtime, PicoClaw/OpenClaw sandbox runtimes, BoxLite, Docker, API, CLI serve, and CLI upgrade.
• Cross-compiled internal/codexcli for Windows amd64 and macOS arm64.
• Built the Docker image and verified bundled Codex (codex-cli 0.144.1), its symlink, and CSGClaw startup.
• validate-pr-message passed.

Impact

• Codex app-server runs on the host from the CSGClaw bundle. PicoClaw/OpenClaw sandbox data flow remains separate and mounts only csgclaw-cli.
• User-installed Codex and sandbox-provider fallback behavior are not used by the Codex runtime.

Notes

• Keep as Draft pending broader review.