fix: refresh comments that still say claude is the only gated CLI (release review)

Codex now declares a version gate too, so the notes in session.ts and
docker-hosts.ts were wrong, the hooks-config caveat described every local codex
when --no-daemon now covers 0.162 and later, and session-routes left network
access out of the launch defaults. architecture-invariants gains --no-daemon and
the network config in its list of Codex flags. Comments and docs only.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/web/routes/session-routes.ts

@@ -1377,8 +1377,9 @@ export function registerSessionRoutes(
     const globalNice = await ctx.getGlobalNiceConfig();
     const modelConfig = await ctx.getModelConfig();
     const mode = body.mode || 'claude';
-    // Synced App Settings launch defaults (capabilities.launchDefaults, codex's model and
-    // effort today) fill the CLI's own config object where the caller left it unset.
+    // Synced App Settings launch defaults (capabilities.launchDefaults, codex's model,
+    // effort and network access today) fill the CLI's own config object where the caller
+    // left it unset.
     // Local launches only: a remote attach runs whatever the remote pane already runs.
     const launchBody = remote ? body : await applyLaunchDefaults(mode, body);
     // Where a model override comes from is a capability, and the three answers are