fix: share Codex auth refresh across profiles

[ablott976]

Summary

• Let profile-isolated Hermes processes borrow root/global OpenAI Codex auth when no local Codex provider state exists
• Refresh borrowed Codex tokens back into the owning/root auth store under that store's lock instead of cloning rotated tokens into profile auth.json
• Extend Codex pool fallback to shared/root pool-only entries and expose auth_scope/auth_store in Codex status
• Document the feature in funciones.txt

Test Plan

• python3 -m py_compile hermes_cli/auth.py
• python3 -m pytest tests/hermes_cli/test_auth_commands.py -q -o 'addopts='

Notes

• Existing profiles with explicit local providers.openai-codex still shadow shared auth by design
• Set HERMES_CODEX_SHARED_AUTH=0 to force strict per-profile Codex auth

[alt-glitch]

Duplicate of #28277 (earliest open PR for sharing Codex OAuth across profiles, addressing #6653). Competing with #34121 and #39796 in the same saturated cluster. Note: this PR bundles a funciones.txt doc artifact that looks fork-specific. Marking duplicate; maintainers can select the canonical implementation.

[liuhao1024]

Accidental commit: funciones.txt in repo root

The diff adds a funciones.txt file at the repository root containing internal implementation notes in Spanish (OpenViking memory controls, Telegram attachment delivery, shared Codex auth). This appears to be a local notes file that was accidentally included in the commit.

funciones.txt | 17 +++++++++++++++++

This file should be removed before merge — it doesn't belong in the repo root and contains no runnable code.

[ablott976]

Closing to avoid unintended upstream notifications. Will continue in fork/local branch before re-opening if needed.