fix(auth): make login status recognize existing Codex authentication

[Ultron09]

Summary

Fixes #670. When a user with an existing ambient Codex authentication session (e.g. in ~/.codex/auth.json or $CODEX_HOME/auth.json) ran codex-security login status or invoked security.account() on a fresh state directory, Codex Security reported "Not logged in".

Ambient credentials were only imported during scan execution (via initialCredentialsAvailable), creating an inconsistency where login status reported not logged in immediately before a scan succeeded using ChatGPT authentication.

Changes

• In sdk/typescript/src/cli.ts: When args.action === "status" and credentialHome exists, invoke initialCredentialsAvailable(dependencies.environment, ambientHome, credentialHome) before executing Codex login status.
• In sdk/typescript/src/api.ts: In CodexSecurity.prototype.account(), invoke initialCredentialsAvailable(...) on authentication.codexHome prior to querying accountStatus().
• Preserves explicit logout marker: initialCredentialsAvailable() continues to enforce codexSecurityCredentialAllowsAmbientImport(isolatedHome), ensuring ambient credentials are never re-imported if the user previously logged out.
• Added regression tests in sdk/typescript/tests-ts/cli-authentication.test.ts and sdk/typescript/tests-ts/api-credentials.test.ts.

Testing

Ran the following checks locally:

• pnpm --dir sdk/typescript run types -> passed with 0 errors
• bun test ./tests-ts/cli-authentication.test.ts ./tests-ts/auth.test.ts ./tests-ts/api-credentials.test.ts -> 43 passed, 2 skipped (platform-specific), 0 failed
• pnpm --dir sdk/typescript run format -> passed (all matched files use Prettier style)
• python .github/scripts/check_plugin_source_compatibility.py -> passed

Risk and rollout

• Low risk: only imports ambient Codex authentication if ambient import is allowed (no logout marker) and no overriding environment API keys are present.
• Fully backwards-compatible with existing Codex Security credential management; no public CLI flags or arguments changed.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.