feat: add Codex CLI provider for subprocess integration

[Leeaandrob]

Summary

• Add CodexCliProvider that wraps codex exec --json as a subprocess, analogous to the existing ClaudeCliProvider pattern
• Add credential reader for ~/.codex/auth.json with token expiry detection (based on file mtime + 1h)
• Integrate into provider factory: provider: "codex-cli" for subprocess mode, auth_method: "codex-cli" for API mode with local CLI tokens
• Fix tilde ~ expansion in workspace path for all CLI providers (cfg.WorkspacePath() instead of raw config value)

New Files

File	Description
codex_cli_provider.go	Subprocess wrapper: builds prompt, runs codex exec --json, parses JSONL events
codex_cli_credentials.go	Reads ~/.codex/auth.json, estimates token expiry from file mtime
codex_cli_provider_test.go	29 tests: JSONL parsing, prompt building, mock CLI, context cancel
codex_cli_credentials_test.go	8 tests: valid/invalid/expired credentials, CODEX_HOME env

Configuration

{
  "agents": {
    "defaults": {
      "provider": "codex-cli",
      "model": "codex-cli"
    }
  }
}

Or use Codex CLI tokens with the HTTP API provider:

{
  "providers": {
    "openai": {
      "auth_method": "codex-cli"
    }
  }
}

Test plan

• All 37 Codex-related unit tests passing
• go vet ./... clean
• Tested locally: picoclaw agent -m "test" returns valid response with provider: "codex-cli"
• Verified no regression on existing providers

[Leeaandrob]

Docker build fix included

The Docker build was failing on all branches (including main) because Dockerfile used golang:1.24-alpine while go.mod requires go >= 1.25.7:

go: go.mod requires go >= 1.25.7 (running go 1.24.13; GOTOOLCHAIN=local)

This PR includes a fix: updated FROM golang:1.24-alpine → FROM golang:1.25-alpine to match the project requirement.

This is a pre-existing issue unrelated to the Codex CLI provider changes.

[spa5k]

I was thinking about doing this myself lol.

[Leeaandrob]

Superseded by upstream codex_provider.go (API-based via OpenAI SDK). The CLI subprocess approach is no longer needed.

[Leeaandrob]

Reopened: The Codex CLI provider (subprocess wrapper for the codex binary) is a different approach from the existing codex_provider.go (API SDK via HTTP). Both serve different use cases, similar to how claude_cli_provider.go coexists with the Anthropic HTTP provider. Closing this was a mistake.

[lxowalle]

Thanks for the pr.