feat: add native Codex harness support

[kengio]

Summary

• add Codex as a first-class harness for skill run and harness run
• add $onebrain:<skill> prompt construction, CODEX_BIN resolution, and safe codex exec argv
• support per-schedule harness: claude|gemini|codex while preserving Claude as the default
• add explicit managed Codex plugin install/update/uninstall with additive config merge and dry-run safety
• bind Codex hook session_id to a full-ID-derived session token so concurrent chats keep checkpoint and wrapup state separate
• bump the CLI to the next sequential patch, 3.4.18, and record ADR 0035

Why

OneBrain needs native Codex parity without changing existing Claude/Gemini behavior. Multiple Codex chats may share one vault, so terminal- or process-scoped checkpoint identity is insufficient.

User impact

onebrain skill run daily --harness codex
onebrain harness run --harness codex "prompt"
onebrain plugin install --harness codex

Scheduled skill entries may set harness: codex; entries without harness continue to use Claude.

Validation

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace
• Codex argv/stub integration tests
• managed install/update/uninstall/dry-run tests
• two-chat SessionStart and Stop-state isolation tests
• three local audit passes and rebase onto latest origin/main