Hermes Talk 0.19.1: read-only Codex subscription lane

Hermes Talk 0.19.1 makes the Codex subscription lane read-only. It never refreshes or rewrites ~/.codex/auth.json again.

• The Codex lane now borrows Hermes' own Codex login first, through hermes_cli.auth_codex.resolve_codex_runtime_credentials. Hermes owns that token store and refreshes it under its lock, so there is one owner of the credential instead of two.
• If Hermes has no Codex login, Talk reads ~/.codex/auth.json read-only. An expired CLI token surfaces a TalkAuthError pointing at codex login or hermes auth login openai-codex instead of a silent refresh.
• Removed _post_token_form, _write_auth_json and _refresh_codex_credential, plus the httpx and tempfile imports they needed. 70 insertions, 205 deletions.
• Tests rewritten to the new contract: the store is byte-identical after an expired token, and a Hermes login wins over the CLI file.

Written by @teknium1 in #146 to clear the one catalog-admission blocker on NousResearch/hermes-agent#108798. Merged as-is at 03b5cd9; all 11 checks green on that head.

No new surface, no new dependency, no behavior change for the API-key lanes or for Grok and Gemini.

Signed-off-by: SmokeDev degensmoke@gmail.com