feat: complete K4 Codex distribution parity

[Jaggerxtrm]

Summary

• add Codex as a third managed skills runtime with an owner-aware .agents/skills projection
• reconcile and verify the Codex skills view during init, doctor, skills commands, and xt codex worktree launch
• retire active Serena enrollment from Core-owned Claude/Pi installer, policy, package, prompt, and current documentation surfaces
• preserve unowned Serena configuration, migration compatibility, disabled source artifacts, and Specialists-owned vendored assets

Why

KAN-127 K4 requires the experimental Codex launcher to receive the same managed lifecycle and distribution guarantees as the existing runtimes without forcing asset-level 1:1 parity. Serena is no longer an installed Claude plugin and must not remain an active XTRM-managed dependency.

Operator impact

• xt skills list|enable|disable accepts --codex; the default target remains all managed runtimes.
• project initialization creates a real .agents/skills directory and manages only links recorded in managedLinks.codex.
• Codex receives global default skills plus selected packs. Unowned entries remain untouched.
• Claude installs only the still-managed context7 official plugin. Pi no longer installs or configures pi-serena-tools or serena-pool.
• xt codex remains experimental until the K5 cross-repository parity gate.

Validation

• npm run build
• npm run typecheck
• 72 focused K4 Core tests
• full CLI suite: 1393 passed, 98 skipped; one independently reproduced pre-existing vendored Stop-hook fixture mismatch
• contract tests: 68 passed
• script tests: 16 passed
• Pi extension/xtprompt tests: 21 passed
• policy, manifest, ownership, registry↔pack, payload hygiene, layout, symlink, skill-budget, forbidden-phrase, deprecation, runtime-compatibility, and Specialists vendor/parity gates
• packed install/update/cleanup/redaction smoke
• push-time Semgrep and OSV checks

Risk

GitNexus reports CRITICAL transitive impact because the central skills-state schema and runtime reconciliation paths change. Backward-compatible v1/v2 normalization, owner-aware link tests, three-runtime integration tests, and package smoke cover that boundary.

Bead: xtrm-ozknq.9

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.