[SilkageNet]

Summary

• add account wake <alias> / account start-window <alias> to send one minimal Codex request without switching accounts
• isolate the request in a temporary CODEX_HOME and empty workspace with an ephemeral session, ignored user config/rules, minimal reasoning, and read-only sandbox
• disable retries for the quota-consuming request, safely reconcile rotated credentials, refresh usage, and record last use
• update the Go patch baseline from 1.26.7 to 1.26.10 after CI identified newly disclosed standard-library vulnerabilities
• document behavior, security boundaries, and CLI compatibility

Validation

• go test ./...
• go test -race ./...
• golangci-lint run
• govulncheck ./... with Go 1.26.10: 0 reachable vulnerabilities
• pre-commit gitleaks, go mod tidy, formatting, lint, race tests, and build
• built v0.4.0-dev and verified both command spellings and help output

The live quota-consuming command was intentionally not run against a real saved account during tests.