fix: share Codex credential pool across profiles

[klvnkeegen]

Summary

• Treat openai-codex as a shared credential-pool provider in profile mode.
• Prefer the root/default Codex pool over stale profile-local Codex entries when reading provider slices or whole-pool data.
• Route write_credential_pool("openai-codex", ...) to the root/default auth store in profile mode, with a path-specific lock, so refresh/exhaustion updates do not fork profile-local OAuth state.
• Preserve existing per-profile shadowing semantics for non-Codex providers.

Test Plan

• PYTHONDONTWRITEBYTECODE=1 python3 -m pytest tests/hermes_cli/test_auth_profile_fallback.py tests/agent/test_credential_pool.py -q -o 'addopts=' -p no:cacheprovider
• PYTHONDONTWRITEBYTECODE=1 python3 -m pytest tests/hermes_cli/test_auth*.py tests/agent/test_credential_pool.py -q -o 'addopts=' -p no:cacheprovider

Local deployment verification

• Backported the same patch into the running Docker image-layer /opt/hermes using root-in-container via the Docker socket because /opt/hermes is root-owned.

[klvnkeegen]

Closing after sustained monitoring with no upstream movement. This PR now conflicts with current main and the local deployment path has been handled separately; keeping the stale watcher/PR open is no longer useful. Happy to reopen or port the Codex shared-pool behavior if maintainers want it.