Fix Codex runner smoke compatibility

[jeffhuber]

Part of #536. Fixes #541.

Summary

• remove stale Codex smoke flags from the macOS runner auth probe
• update runner/build-loop docs with the supported Codex smoke command
• add non-interactive API-key login guidance using codex login --with-api-key
• add regression tests so the stale flags stay out of the docs and probe command

Verification

• scripts/dev-python -m unittest tests.test_doctor_self_hosted_runner.SelfHostedRunnerDoctorTests.test_runner_cli_auth_codex_probe_omits_stale_smoke_flags tests.test_release_hygiene.ReleaseHygieneTests.test_codex_smoke_docs_use_supported_flags
• scripts/dev-python -m pytest tests/test_doctor_self_hosted_runner.py tests/test_release_hygiene.py
• scripts/dev-python -m ruff check src/code_mower/doctor_checks/self_hosted_runner.py tests/test_doctor_self_hosted_runner.py tests/test_release_hygiene.py
• scripts/dev-python -m ruff check .
• scripts/dev-python -m pytest
• git diff --check
• scripts/dev-python scripts/privacy_scan.py
• live Codex smoke with codex exec --skip-git-repo-check --sandbox read-only --output-last-message ... "Reply with exactly: ok" returned the expected sentinel

Privacy

Metadata/docs/probe-command only. No source, diffs, transcripts, raw stdout/stderr, auth output, local paths, or secrets are uploaded or persisted by this change.

[gitar-bot]

Code Review ✅ Approved

Removes stale Codex smoke flags from the macOS runner auth probe and updates documentation with the supported codex login --with-api-key command, along with regression tests to prevent flag staleness. No issues found.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[jeffhuber]

Claude audit (merge-authority lane)

Head SHA: de68e871b58285875c31762c19838cfd87544854
Findings: P0=0, P1=0, P2=0, P3=1 (blocker policy: any P0/P1/P2 -> BLOCKED)

Claude Audit: PASS

Summary:

Removes stale unsupported codex exec flags and adds documented API-key login path; changes are small, mirrored between code and docs, and covered by new tests. No blocking issues found.

Findings:

• [P3] Unverified codex login flag -- docs/self-hosted-mac-runner.md:66
  Finding ID: claude:b49a36da948f79385dda
  Docs introduce codex login --with-api-key reading key from stdin; not verified against actual CLI, low risk documentation-only item.