Isolate Codex app-server state per agent (#74556)

* fix(codex): isolate app-server home per agent

* fix(codex): isolate native Codex assets per agent

* fix(channels): mark inbound system events untrusted

* fix(doctor): warn on personal Codex agent skills

* test(doctor): cover personal Codex agent skills warning

* fix(codex): forward auth profiles to harness runs

* fix(codex): preserve auto auth for harness runs

* fix(codex): auto-select harness auth profiles

* test(codex): type harness auth mock

* feat(codex): select migrated skills

* fix(codex): satisfy migration selection lint

* docs: add codex isolation changelog

extensions/codex/index.test.ts

@@ -17,6 +17,7 @@ describe("codex plugin", () => {
     const registerAgentHarness = vi.fn();
     const registerCommand = vi.fn();
     const registerMediaUnderstandingProvider = vi.fn();
+    const registerMigrationProvider = vi.fn();
     const registerProvider = vi.fn();
     const on = vi.fn();
     const onConversationBindingResolved = vi.fn();
@@ -32,6 +33,7 @@ describe("codex plugin", () => {
         registerAgentHarness,
         registerCommand,
         registerMediaUnderstandingProvider,
+        registerMigrationProvider,
         registerProvider,
         on,
         onConversationBindingResolved,
@@ -55,6 +57,10 @@ describe("codex plugin", () => {
       name: "codex",
       description: "Inspect and control the Codex app-server harness",
     });
+    expect(registerMigrationProvider.mock.calls[0]?.[0]).toMatchObject({
+      id: "codex",
+      label: "Codex",
+    });
     expect(on).toHaveBeenCalledWith("inbound_claim", expect.any(Function));
     expect(onConversationBindingResolved).toHaveBeenCalledWith(expect.any(Function));
   });