fix: refresh comments that still say claude is the only gated CLI (release review)

Codex now declares a version gate too, so the notes in session.ts and
docker-hosts.ts were wrong, the hooks-config caveat described every local codex
when --no-daemon now covers 0.162 and later, and session-routes left network
access out of the launch defaults. architecture-invariants gains --no-daemon and
the network config in its list of Codex flags. Comments and docs only.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/docker-hosts.ts

@@ -1682,9 +1682,9 @@ export async function probeDockerCliVersion(
   if (IS_TEST_MODE) return undefined;
   // ⚠️ The MODE NAME IS NOT ALWAYS THE BINARY NAME — `antigravity` runs `agy`. This used
   // to pass the mode straight through as the command, which would have probed a binary that
-  // does not exist. Only claude reaches this today (it is the one CLI with a version gate),
-  // so nothing was actually broken, but the registry is what makes it correct for the next
-  // CLI that needs a version.
+  // does not exist. Claude and codex reach this today (the CLIs with a version gate), and
+  // both binaries match their mode, so nothing was actually broken, but the registry is what
+  // makes it correct for the next CLI that needs a version.
   const bin = getCli(mode)?.discovery.binaries[0];
   if (!bin) return undefined; // `shell` has no binary of its own
   const argv = dockerEngineArgv(docker);