refactor(pi): drop Codex auth broker for proxy-based subscription support

The host-side streaming Codex proxy (custom baseUrl in models.json + OAuth
credential in auth.json) makes the in-guest auth broker unnecessary. Stock Pi
resolves the subscription through its normal openai-codex-responses provider,
so remove the codex-auth extension, its launcher wiring, packaging, dependency,
and tests. The Pi 0.83 packaging and durability wrappers (cwd preservation,
guest-safe version probe, ACP session recovery) are retained.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: tobowers

pnpm-lock.yaml

@@ -31,7 +31,6 @@
 	},
 	"dependencies": {
 		"@agentclientprotocol/sdk": "1.2.1",
-		"@earendil-works/pi-ai": "0.83.0",
 		"@earendil-works/pi-coding-agent": "0.83.0",
 		"pi-mcp-adapter": "2.11.0",
 		"zod": "3.25.76"

software/pi/extensions/codex-auth.mjs

@@ -30,7 +30,6 @@ const wrapperPath = resolve(packageDir, "wrappers", "pi-agentos.mjs");
 const acpWrapperPath = resolve(packageDir, "wrappers", "pi-acp-agentos.mjs");
 const acpErrorsPath = resolve(packageDir, "wrappers", "acp-errors.mjs");
 const piCommandPath = resolve(packageDir, "wrappers", "pi-command.mjs");
-const extensionPath = resolve(packageDir, "extensions", "codex-auth.mjs");
 
 function sha256(path) {
 	return createHash("sha256").update(readFileSync(path)).digest("hex");
@@ -119,8 +118,6 @@ cpSync(wrapperPath, resolve(packageDir, "dist", "pi-agentos.mjs"));
 cpSync(acpWrapperPath, resolve(packageDir, "dist", "pi-acp-agentos.mjs"));
 cpSync(acpErrorsPath, resolve(packageDir, "dist", "acp-errors.mjs"));
 cpSync(piCommandPath, resolve(packageDir, "dist", "pi-command.mjs"));
-mkdirSync(resolve(packageDir, "dist", "extensions"), { recursive: true });
-cpSync(extensionPath, resolve(packageDir, "dist", "extensions", "codex-auth.mjs"));
 
 mkdirSync(dirname(manifestPath), { recursive: true });
 writeFileSync(