fix: use Codex account default model

[HartBrook]

Summary

Codex CLI was receiving API model IDs such as gpt-5.3-codex and gpt-6-sol, even though ChatGPT-plan model availability is separate from API availability. This caused guided-review generation to fail with a 400 model-not-supported response on some machines.

• expose a single Codex Account default choice and omit --model, allowing the installed CLI and signed-in account to choose a supported model
• keep named GPT models under the direct OpenAI API provider and migrate stale browser selections to a valid choice
• normalize Codex model/authentication failures into actionable UI messages and show model setup only when it is a relevant recovery action
• give the model an explicit per-file line-anchor checklist so account-default generation reliably satisfies Wingdiff's strict evidence-coverage contract
• add opt-in local live E2E commands that use existing gh and codex logins while remaining isolated from CI and GitHub publishing
• cover CLI arguments, catalog validation, saved-selection migration, generation failures, prompt coverage, and the reviewer flow

Verification

• npm test — 119 server tests and 49 web tests passed
• npm run build — web and server production builds passed, including TypeScript checks
• npm run test:e2e — all 5 deterministic Chromium flows passed
• npm run test:e2e:live:acquire — real PR acquisition passed in 4.6 seconds
• npm run test:e2e:live — real GitHub acquisition and Codex account-default generation passed in 1.1 minutes
• real PR fix: use Codex account default model #13 — Codex CLI Account default generated and opened a validated guided review
• git diff --check

Risk and privacy

The behavior change is limited to provider/model selection, generation guidance, error presentation, and an explicitly invoked local-only test harness. Codex still receives review evidence through its existing isolated local CLI invocation; direct API providers retain explicit named-model selection. The live suite uses a temporary database, never enters the publish flow, refuses to run in CI, and cleans up by default. Failure artifacts remain local and are gitignored. No credentials, private source, or local Wingdiff data are added to the repository.

Checklist

• The change is focused and documented.
• Tests cover behavior changes, or I explained why tests are unnecessary.
• npm test, npm run typecheck, and npm run build pass.
• I added screenshots for visible UI changes. The small failure-state recovery action is covered by the reviewer browser flow and real-PR tests.
• I did not commit credentials, private source, or local Wingdiff data.