fix(codex): preserve live model catalog authority

[tschosch55]

Summary

• preserve successful account-specific Codex catalog authority end to end, including empty/all-hidden catalogs
• distinguish live discovery failures from authoritative empty catalogs and reject absent configured/requested slugs only when live authority exists
• prevent generic provider-cache fallback from resurrecting stale Codex models
• filter six retired/offline-only Codex slugs while allowing a live catalog to re-advertise them
• accept documented gateway/runtime root configuration keys in strict validation

Verification

• 940 passed across all Codex-related test files plus config validation, model validation, provider-resolution, model-switch, and inventory contracts
• Ruff passed on every changed Python file
• git diff --check passed
• live account probe returned one authoritative catalog used identically by discovery, picker, and cached-provider paths; gpt-5.6-sol validated and absent gpt-5.6-sol-pro failed closed
• active config validation returned zero issues

The installed Hermes checkout and running gateway were not modified by this change.

[teknium1]

Thanks for tracing the live-catalog provenance through discovery, picker, cache, and validation. The current-main premise is real: get_codex_model_ids() falls through whenever the live result is empty (hermes_cli/codex_models.py:236-240), and the generic cache can then restore stale entries (hermes_cli/models.py:3006-3015).

Problems

• The new authoritative-empty rule also applies when no ChatGPT-Account-Id was recovered. Current main documents that a header-less /models probe returns HTTP 200 with {"models": []} and must degrade to fallback (hermes_cli/codex_models.py:97-109; c44c2fbb0b). The PR's new discovery path makes that same response authoritative, so opaque/malformed tokens can cause the CLI to reject all models rather than use the offline catalog.

Suggested changes

• Carry whether the account header was sent into the discovery decision; only an account-scoped empty response should be authoritative.
• Add a mocked malformed-token + 200-empty regression test alongside the authoritative-empty test.

Automated hermes-sweeper review.