feat(plugin): add local Codex service

[superche]

Summary

• add the codex-service v5 Plugin and separately distributed convax-codex-mcp companion
• bind an existing local Codex installation and account without copying credentials
• expose GPT-5.6 Sol/Terra/Luna and GPT-5.5 through an authenticated Main-only loopback LLM gateway
• expose GPT Image 2 generation, including reference images and portable output artifacts
• project bounded account, credential, usage, and optional credit status into Convax Services
• add convax.plugin/5 Registry/schema/tooling support with the convax.plugin-capability/1 compatibility broker

Why

Convax needs a reviewed Plugin boundary for using the user's existing local Codex installation. The Plugin keeps Codex credentials and upstream transport inside Codex/the verified sidecar while Convax receives only bounded model metadata, service status, generated artifacts, and a process-lifetime loopback gateway.

Runtime validation

Validated against local Convax origin/convax-next@751293309 in Electron:

• registered and installed codex-service v0.1.1 through the catalog
• verified the managed companion and execution authorization receipt
• observed service state connected with verified local account metadata and quota usage
• resolved the Codex GPT-5.6 provider in the Agent model catalog
• generated a real GPT Image 2 artifact and admitted it into Canvas as a 1536 x 1024 PNG
• fixed the initial absolute artifact-path failure by returning paths relative to output_directory

Checks

Passed:

• bun install --frozen-lockfile --ignore-scripts
• source validation at Registry sequence 23
• workspace typechecks
• workspace tests: Codex 16, FFmpeg 33, XiaoYunque 106
• tooling tests: 55
• Codex darwin-arm64 companion release build
• deterministic package packing and Registry/Showcase index builds
• real Electron registration, installation, account binding, LLM selection, and GPT Image 2 generation

Known unrelated failure:

• the repository-wide bun check reaches build:companions and fails in the existing FFmpeg compiled-companion smoke because it does not return the expected source.mp4 artifact. FFmpeg's 33 workspace tests pass, and this PR does not modify FFmpeg source.