fix(auth): guard shared Codex store consumers

[cooper-oai]

Summary

Part 5 of 8. Depends on part 4.

• protect media delivery and model-cache consumers of the shared Codex store
• fail closed for pre-upgrade unclaimed refresh families
• remove refresh-linked aliases when the canonical family is removed
• sanitize merged pool payloads and prune borrowed stale rows

Why

All consumers must observe the canonical Hermes-owned state, and ambiguous or borrowed token rows must not reach refresh or reappear through merge paths.

This is a fork-local stacked draft. Promote it upstream after part 4 lands.

Validation

• focused suite at this layer: 433 passed, 2 skipped
• ruff, py_compile, Windows footgun scan, and git diff --check: clean

Stack

Priority order, highest to lowest:

1. NousResearch/hermes-agent#34820 — prevent Hermes Codex OAuth refresh-token reuse
2. cooper-oai/hermes-agent#1 — share canonical Codex state across profiles
3. cooper-oai/hermes-agent#2 — reconcile stale Codex pool snapshots
4. cooper-oai/hermes-agent#3 — migrate linked Codex aliases safely
5. cooper-oai/hermes-agent#4 — guard shared Codex store consumers
6. cooper-oai/hermes-agent#5 — quarantine Codex families by composite identity
7. cooper-oai/hermes-agent#6 — harden Codex migration and fallback routing
8. cooper-oai/hermes-agent#7 — avoid Codex refresh contention and fix guidance

Part 1 targets upstream main. Parts 2-8 are fork-local dependent drafts so each diff stays reviewable; promote each part upstream after the part below it lands.