feat: supervised permission mode for Codex provider

[chuks-qua]

What

Implement interactive tool permission approval for the Codex provider, completing Phase 2 of the supervised permission mode feature.

Why

Phase 1 (#156) delivered the full end-to-end permission flow for Claude via the canUseTool SDK callback. Codex uses a different mechanism — approvalPolicy: "on-request" with a JSON-RPC approval handler in codex-app-server. The shared infrastructure (push channels, RPC methods, PermissionRequestCard, store, sidebar indicator) is already in place from Phase 1.

Scope

• Investigate the Codex codex-app-server approval RPC protocol (see apps/server/src/providers/codex/)
• Implement resolvePermission and listPendingPermissions on the Codex provider
• Wire the existing permission_request / permission_resolved EventEmitter events into the Codex approval handler
• Verify the existing PermissionRequestCard renders correctly for Codex tool calls

Out of scope

• "Always allow" persistence (deferred — see discussion in feat: implement canUseTool for proper supervised permission mode #156)
• Copilot provider (blocked on SDK support)

Related

Phase 1: #156

[chuks-qua]

Acceptance Criteria

• In supervised mode, Codex tool use triggers the same PermissionRequestCard in the chat view that Claude does.
• Allow once and Deny both function correctly for Codex sessions and unblock the underlying tool call.
• Allow-for-session works within the Codex session (mirrors Phase 1's SDK-suggestion behavior; persisted Always-allow remains out of scope per feat: implement canUseTool for proper supervised permission mode #156).
• Full-access mode (approvalPolicy: "never", sandbox: "danger-full-access") continues to bypass all prompts with no regression.
• Claude and Copilot providers are unaffected.
• Sidebar amber pulsing dot appears on Codex threads with pending permission requests.
• Pending permissions are cleared on thread close, agent turn end, and provider shutdown (no leaked waiters).

Folded in from #269 before closing it as a duplicate.