#3673 feat(trace): e2e adapter for Codex

Part of #3635 (spec issue-3635). Adds a Codex column to the Chainloop Trace end-to-end suite, ahead of Codex support in Trace.

This change goes against a non-goal of spec issue-3635: "test Codex or other agents with no Trace provider". The Codex column is added first on purpose, the same way as the Pi column. Each cell is No until a Codex provider exists.

• A Codex adapter runs codex exec --json with the scenario prompt, with no sandbox and no approvals, in the throwaway workspace. The project hooks run with --dangerously-bypass-hook-trust. The Codex configuration folder (CODEX_HOME) is next to the workspace, so the configuration, hooks, skills, and sessions of the user who runs the suite do not load. --ignore-user-config is not used, because it also turns off the project hooks in .codex/hooks.json. Pasted images go in with --image. Skills go in .agents/skills.
• A model with the openrouter/ prefix runs on OpenRouter through a provider override, with OPENROUTER_API_KEY. Any other model runs on the default Codex provider, with CODEX_API_KEY.
• Codex is pinned to 0.163.0 with openrouter/openai/gpt-5-mini.
• The feature tables get a Codex column. A run with the cells set to Unknown gave an error for each testable cell: chainloop trace init --codex fails with "unknown flag: --codex". So each Codex cell is No, the README tells why, and the suite skips the column. When Codex support is added, set the cells to Unknown and run the suite to fill them.
• The adapter reports no hook messages, and it cannot remove the session-start hook, until Trace has a Codex provider.

AI disclosure: Claude Code helped to write this change.