cli(feat): add linked configuration profiles

[Jacques2Marais]

Summary

• Add codex-profile init <target> --share-with <source> for linked configuration profiles.
• Create the target as a real mode-700 directory and link only existing allowlisted paths: config.toml, Codex instruction files, rules/, and plugins/.
• Keep auth.json, sessions, logs, Electron data, caches, skills, and connector/app state separate.

Review revisions

• Rebased the PR from its v0.2-era base onto current main without restoring removed Desktop clone or global-quit behavior.
• Replaced broad top-level discovery with an explicit seven-path allowlist.
• Added strict source/target validation, dangling-symlink checks, and cleanup after link or permission failures.
• Restored stock macOS Bash 3.2 compatibility by removing the associative-array design.
• Synchronized help, Bash/Zsh/Fish completions, README, docs/llms.txt, security guidance, changelog, agent guidance, and AUR metadata.
• Preserved Jacques Marais as the feature commit author.

Validation

• make test
• make lint
• git diff --check
• Full behavior coverage for the allowlist, missing entries, source symlinks, private state exclusions, existing targets, usage errors, and partial-failure cleanup.

Closes #3

[Ducksss]

I think this is worth accepting, but as a narrow linked-profile mode rather than “symlink most of CODEX_HOME”.

Proposed shape:

• codex-profile init personal-2 --share-with personal-1
• create ~/.codex-personal-2 as a real private directory
• symlink only an explicit allowlist from the source profile:
  • config.toml
  • AGENTS.md
  • AGENTS.override.md
  • instructions.md
  • custom-instructions.md
  • rules/
  • plugins/
• always keep auth.json, sessions/, logs/, electron-user-data/, caches, and connector/app state separate
• fail if source profile is missing, source equals target, or a target path already exists

That preserves the project’s “don’t read/copy auth tokens” boundary while solving the live shared-config use case. I’d skip session/log sharing for the first version; add it later only if there’s real demand.