Add Codex OAuth LLM provider

[ethanj]

Summary

• Adds LLM_PROVIDER=codex to core provider config and provider construction.
• Replaces the shell-out Codex implementation with a direct OAuth-backed provider: core reads the auth file created by codex login (CODEX_AUTH_PATH, CODEX_HOME/auth.json, or ~/.codex/auth.json) and posts to the Codex backend directly.
• Documents the local Codex extraction mode in core and the Codex plugin README.
• Removes the pinned @openai/codex CLI install from the core Docker image; Docker QA now mounts only a copied Codex auth home.

Verification

• pnpm --filter @atomicmemory/core test -- src/services/__tests__/codex-llm.test.ts src/services/__tests__/llm-providers.test.ts src/__tests__/config-env.test.ts --reporter verbose
• pnpm --filter @atomicmemory/core typecheck
• pnpm --filter @atomicmemory/core build
• pnpm --filter @atomicmemory/core code-health
• git diff --check
• Docker QA from ops: bash ci/run-required.sh --tests core-extraction --allow-partial --host-tools none --llm-provider codex passed with 1 passed row, 0 failed rows, 0 skipped rows.

Notes

This mode is intended for local personal development. It consumes the logged-in Codex account limits and is not intended for hosted or team deployments. Claude Code was not changed; both Hindsight and AtomicMemory use the Claude Agent SDK path for Claude account auth.

[ethanj]

Closed as superseded by the internal-first flow. The reviewed and green internal PR atomicstrata/atomicmemory-internal#3 was merged to internal main and then published to public main per the documented workflow.