feat: isolate Codex providers per hat

[Colafornia]

Summary

• add hats <hat> -- <command...> so a Hat environment can launch a replacement CLI
• select the isolated config home from the executable that actually runs
• when that executable is Codex, derive a process-local provider from OPENAI_BASE_URL and OPENAI_API_KEY
• fail before launch when Hat provider data is incomplete; preserve explicit Codex profile/provider overrides
• keep hats exec environment-only and avoid profile files or a duplicate codex = {...} schema

Why

A Hat that owns provider configuration must not silently inherit the global Codex model_provider. This keeps Hats as a thin launch and isolation layer while preventing requests from reaching the wrong gateway.

This supersedes #2 with env-derived configuration, replacement-command support, basename detection, and explicit override handling.

Validation

• npm run typecheck
• npm test — 125 passed