Harden Codex maintenance seams

[dd3ok]

Summary

• keep Codex storage inspection opaque and read-only while isolating optional CLI probes
• make doctor --json opt-in, preserve caller CWD, and reject unknown schemas without interpreting them
• block archive/delete automation and keep unarchive outside this storage skill
• update the canonical user-skill path and document external state/log coverage limits

Safety and compatibility

• inventory survives unavailable or unsupported Codex launchers
• doctor, version, and lifecycle capability failures are reported explicitly and independently
• no raw Codex database, rollout, process, plugin, or cache mutation is implemented
• future opaque top-level storage remains measurable without private-format knowledge

Validation

• python -I -B .\codex-cleaner\scripts\test_codex_storage_guard.py (14 tests)
• isolated skill-creator quick validation with PyYAML
• live Codex 0.147.0-alpha.6.6 default and opt-in doctor probes
• Standards review: no findings
• Spec review against the official/integrated audit: no findings