feat(codex): let Codex sessions drive other sessions through the codeman skill

Measured on 1.47.0 with the same "spawn a shell worker, echo, read, delete"
task: DeepSeek Harness and OpenCode already pass end to end; Codex 0.162
failed three ways, fixed here.

- Start Codex 0.162+ with --no-daemon (new noDaemonFlag gate, fail-closed).
  The shared app-server daemon stopped every launch on an "incompatible
  feature settings" dialog when another version's daemon was running, and
  ran commands with another session's CODEMAN_* environment.
- Evaluate registry version gates against the gated CLI's own version
  (resolveSessionCliVersion) instead of claude's for every entry.
- Add the opt-in synced setting App Settings > Codex > Allow network access
  (codexNetworkAccess, default off): --config
  sandbox_workspace_write.network_access=true, filled as a launch default
  and clamped off for non-granted owners like the bypass switch.
- Skill: carry on with the curl path when `codeman` is not on PATH, re-run a
  sandbox-blocked call once through the CLI's approval path, name the new
  setting. Wiki and registry docs updated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/tmux-manager.ts

@@ -1163,8 +1163,9 @@ export function buildSpawnCommand(options: {
   /** Name pinned on claude as `--name` (version-gated, sanitized; local spawns only). By default only a user-chosen name; `pinCliSessionName` pins every tab name: see `Session.cliPinnedName`. */
   sessionName?: string;
   /**
-   * Claude CLI version for the `--name` gate. Omitted = probe the local CLI
-   * (getClaudeCliVersion; null under vitest). Tests inject a value here; the
+   * CLI version for the launch template's version gates (claude's `--name`, codex's
+   * `--no-daemon`). Omitted = probe the mode's own local CLI (resolveSessionCliVersion;
+   * null under vitest). The name predates the second gated CLI. Tests inject a value here; the
    * docker/remote paths never see this builder's output, which is what keeps the
    * gate measuring the RIGHT binary, the local one.
    */