0.2.0 set `required = true` on the agentsid guard MCP. That would be
correct if the guard package existed on npm — but `@agentsid/guard` was
never published. Every Codex user who cold-installed 0.2.0 saw:

    npm error 404 Not Found - GET https://registry.npmjs.org/@agentsid/guard
    ERROR Failed to create session: required MCP servers failed to
    initialize: agentsid: handshaking with MCP server failed
    Error: thread/start failed during TUI bootstrap

Codex was doing exactly what `required=true` told it to: fail-closed on
missing guard. Our claim that the posture was "stable" assumed a working
guard package — that assumption was wrong.

This commit flips to `required=false` so Codex boots with the kernel
sandbox active even when the MCP handshake fails. Same failure posture
Cursor and Claude Code already have — red MCP badge, app still runs,
hook/sandbox-based enforcement unaffected.

The real fix is to actually publish @agentsid/guard. The package lives
at mcp-shell-guard/ in the monorepo and declares name=@agentsid/guard,
v0.1.0 — it needs audit, tests, a publish workflow, and explicit sign-
off before it goes live. Tracking that separately.

Live-verification for 0.2.1 after publish:
  1. Cold install `@agentsid/setup@0.2.1`, walk wizard → Codex
  2. Run `codex` — expect: boots to the TUI without the bootstrap error
  3. Expect a red badge on the agentsid MCP (still 404s in the bg)
  4. Kernel sandbox still enforces — `sandbox_mode = "workspace-write"`