feat(wiring): write Codex OPENAI_API_KEY into auth.json - #45

What changed: Codex wiring now writes OPENAI_API_KEY into ~/.codex/auth.json (merged, atomic, 0600) alongside the existing config.toml provider block, so a fresh shell does not need the env var set.

Closes #16

How it was verified:

• mise run ci:app - passed (typecheck, lint, unit tests including the new codex-auth cases, and full build)
• mise run ci:cli - passed (typecheck and compiled CLI build). The CLI picks this up with no change because cli/src/lib/wiring.ts re-exports applyWiring from the shared wiring layer.

Proof (logic-only slice, no live provider key used):

New tests in scripts/test-codex-auth.mjs, run as part of npm test:

  ✓ codexAuthPath joins .codex/auth.json
  ✓ darwin write reports changed
  ✓ auth.json contains OPENAI_API_KEY
  ✓ auth.json mode is 0600
  ✓ second write reports changed
  ✓ OPENAI_API_KEY updated
  ✓ existing auth.json keys preserved
  ✓ linux skips with env note
  ✓ linux does not create auth.json
  ✓ win32 skips with env note
  ✓ win32 does not create auth.json
  ✓ storeInFile false skips write
  ✓ empty api key skips write
  ✓ applyWiring codex returns two results
  ✓ applyWiring includes changed auth.json result
  ✓ applyWiring includes config.toml result
  ✓ applyWiring wrote key into auth.json
all codex-auth cases passed

Fixture run against the built writer, credential redacted, existing content preserved:

result: {"path":"<tmp>/.codex/auth.json","changed":true}
auth.json: {"tokens":{"id":"keep-me"},"OPENAI_API_KEY":"sk-...redacted"}
mode: 0600

Reviewer notes:

• Platform behaviour follows the issue acceptance: on Linux and Windows the writer skips and returns the note "Codex on this platform reads OPENAI_API_KEY from env; please set it in your shell". Only macOS writes the file in this slice. If you want Linux to write too, that is a one-line change to the platform guard in src/main/wiring/codexAuth.ts.
• applyWiring for codex now returns two entries in the result array (config.toml, then auth.json), so both show up in the IPC response. The skip case still returns an entry with changed: false and the note, so the renderer can surface it.
• Verifying that a real codex binary picks the key up from auth.json in a fresh shell needs a real Codex install and a real key, which this run did not use. The file shape, merge, and permissions are covered by the tests above.
• Nothing user-facing changed in the renderer. No screenshot, because the change is in the wiring layer only.