fix(auth): share canonical Codex state across profiles

[cooper-oai]

Summary

Part 2 of 8. Depends on part 1.

• store named-profile Codex OAuth state in the canonical Hermes root store
• keep independent manual Codex credentials profile-local
• clear profile Codex credentials correctly during logout
• merge shared status updates without copying profile-local state

Why

Named profiles must share one serialized Codex refresh-token family without overwriting independent manual credentials or leaking stale profile state back into the canonical store.

This is a fork-local stacked draft. Promote it upstream after part 1 lands.

Validation

• focused suite at this layer: 399 passed, 2 skipped
• ruff, py_compile, Windows footgun scan, and git diff --check: clean

Stack

Priority order, highest to lowest:

1. NousResearch/hermes-agent#34820 — prevent Hermes Codex OAuth refresh-token reuse
2. cooper-oai/hermes-agent#1 — share canonical Codex state across profiles
3. cooper-oai/hermes-agent#2 — reconcile stale Codex pool snapshots
4. cooper-oai/hermes-agent#3 — migrate linked Codex aliases safely
5. cooper-oai/hermes-agent#4 — guard shared Codex store consumers
6. cooper-oai/hermes-agent#5 — quarantine Codex families by composite identity
7. cooper-oai/hermes-agent#6 — harden Codex migration and fallback routing
8. cooper-oai/hermes-agent#7 — avoid Codex refresh contention and fix guidance

Part 1 targets upstream main. Parts 2-8 are fork-local dependent drafts so each diff stays reviewable; promote each part upstream after the part below it lands.