fix(cli): pass granular Codex runtime options

[rawwerks]

Summary

• forward PROSE_CODEX_ADD_DIR into Codex SDK additionalDirectories
• forward strict PROSE_CODEX_NETWORK=true|false into networkAccessEnabled
• document the new Codex harness env vars
• refresh vulnerable transitive production lockfile entries so CLI release audit stays green

This PR targets main directly and contains only the Codex runtime-options fix. The earlier PR #77 landed the same fix into feat/cli-prose-chain; this PR is the main-targeted cherry-pick.

Verification

• npm ci
• npm run typecheck
• TMPDIR=/var/tmp/prose-codex-tests npm test -- tests/harnesses/harnesses.test.ts
• npm audit --omit=dev
• git diff --check origin/main..HEAD

Golden-finch also confirmed the patch end-to-end with workspace-write, PROSE_CODEX_ADD_DIR, and PROSE_CODEX_NETWORK=true against a live grant-radar run.

[rawwerks]

Reviewed against the contribution bar from #75.

No blocking issues found.

Standards check:

• Use case / evidence: clear. The PR names the runtime-options gap, explains this is the main-targeted cherry-pick of fix(cli): pass granular Codex runtime options #77, and includes live run evidence from the grant-radar flow.
• One responsibility: acceptable. The functional change is narrowly scoped to Codex SDK runtime options; the lockfile refresh is supporting work for the stated CLI release audit.
• Layer boundary: correct. This belongs in tools/cli harness code and README docs, not in OpenProse language/spec semantics.
• Retestable checks: good. The test covers merged additionalDirectories, strict PROSE_CODEX_NETWORK=true, sandbox mode, approval policy, and invalid network values.

I verified locally on the PR worktree:

• npm run typecheck
• TMPDIR=/var/tmp/prose-codex-tests npm test -- tests/harnesses/harnesses.test.ts
• npm audit --omit=dev
• git diff --check origin/main..HEAD

All passed. GitHub Actions for the head commit are also green: OpenProse Smoke, CLI Real Harness Smoke, and CLI Release Check.

Residual non-blocking gap: there is no explicit PROSE_CODEX_NETWORK=false assertion, but the implementation handles false correctly by checking networkAccessEnabled === undefined rather than truthiness. Not worth blocking.

Note: I attempted to submit this as an approving review, but GitHub rejected it because the authenticated account cannot approve its own PR, so I’m leaving it as a standards-based review comment instead.