feat(codex): add durable sandbox jobs and docs awareness

[pratikbin]

Changes

The Codex plugin previously provided shell workflows through a skill and hooks. This change adds local MCP tools for durable sandbox jobs: a submission returns a job ID, the worker survives a closed MCP client, and users can inspect logs, exit codes, cleanup warnings, and retrieved files later.

• Add portable plugin/MCP manifests and current hook wiring while retaining compatibility manifests.
• Ship eight MCP tools and a bundled MCP Apps job panel with conversation and sidebar entrypoints.
• Deny outbound access by default, scope uploads to the workspace, and retrieve bounded individual artifacts into private job storage.
• Persist output before cleanup and retain sandboxes when execution or artifact retrieval is uncertain.
• Add a documentation skill that reuses the Claude Code plugin's shared live docs index, plus startup/MCP routing and developer usage examples.
• Correct hostname egress guidance in canonical and synchronized references.
• Prevent local Bash startup files from changing the shared engine's CLI environment; synchronize the Pi copy.

Validation

• npm run check: type checking, bundle build, and 26 passing tests.
• Detached-worker integration uses a fake CreateOS CLI and real tmux, and verifies completion after the MCP client disconnects.
• bun test ../shared/sandbox-engine.test.ts: 21 passing tests.
• Skill validation, hook syntax, shared-file synchronization, and diff checks pass.

Release scope

Local stdio integration only. Hosted OAuth, an app connection, live cloud validation, and visual validation in a real MCP Apps host remain before release. Generated bundles are included so installation does not require node_modules.