chore(codex): bump Codex CLI to 0.155.0

[backryun]

Summary

Bump the emulated Codex client fingerprint to the current @openai/codex release, in one lockstep change:

• src/shared/constants/codexClient.ts — DEFAULT_CODEX_CLIENT_VERSION 0.153.4 → 0.155.0
• Dockerfile — image install @openai/codex@0.155.0, kept in lockstep with the header fingerprint
• .env.example, docs/reference/ENVIRONMENT.md, docs/security/STEALTH_GUIDE.md — documented defaults/overrides
• tests/snapshots/provider/translate-path.json, tests/unit/executor-codex.test.ts — golden and header assertions

Split out of #12759 as requested in review: the catalog PR should not carry the client pin. Dropping the commit there left the pin at the deliberate #13026 value; this PR moves that pin forward in one coordinated bump instead, so the fingerprint OpenAI sees from the OAuth/Responses face matches the real client version installed in the image.

Validation

• node --import tsx/esm --test tests/unit/executor-codex.test.ts tests/unit/provider-translate-path-golden.test.ts — 50/50
• @openai/codex@0.155.0 is the current npm latest (0.156.0-alpha.1 is still a pre-release).
• Live Codex OAuth smoke passed on the previous revision of this bump (0.154.0): 32/33 models including every gated gpt-6-astra tier returned 200 — the smoke comment below has the details. This update only moves the same lockstep change to the current release; a re-run can be posted on request.
• check:env-doc-sync is currently red on the clean tip for unrelated vars (OMNIROUTE_STRIP_SYSTEM_PREAMBLE, COMBO_LOOP_SAFETY_TIMEOUT_MS); nothing in this PR touches that contract.

[backryun]

Live smoke — passed

Environment: local server built from this branch (DEFAULT_CODEX_CLIENT_VERSION = "0.154.0", no CODEX_CLIENT_VERSION override), one Codex OAuth connection, dashboard "Test all models" run (POST /api/models/test-all, 2026-09-15T23:28Z).

Result: 32/33 models returned 200 through the ChatGPT/Codex OAuth backend, including the gated GPT-6 Astra series:

• gpt-6-astra, -low, -medium, -high, -xhigh, -max, -ultra — all 200
• gpt-5.6-sol / -terra / -luna tiers — all 200
• gpt-5.5 tiers — all 200

The single 400 is gpt-5.3-codex-spark. Re-tested directly, the upstream answer is:

The 'gpt-5.3-codex-spark' model is not supported when using Codex with a ChatGPT account.

That is an account-type limitation of that specific model, independent of the client version (no requires a newer version of Codex response anywhere in the run). Spark is also on the upstream retirement list for 2026-10-14, so it will drop out of the catalog either way.

The successful Astra calls are the strongest signal here: the gated GPT-6 models are the ones a stale client version gets refused on, and every tier passed on 0.154.0.

[backryun]

Rebased onto the current green tip (release/v3.8.51 @ 0d089e7e3) and ready for review.

Live Codex OAuth smoke passed on this build — 32/33 models including every gated gpt-6-astra tier (details in the smoke comment above). Focused tests executor-codex + provider translate-path golden: 46/46, npm run check:env-doc-sync clean.

Note: this is the split-out of #12759's Codex bump per review — the pin moves forward in lockstep (constant + Dockerfile + docs + golden) instead of being carried by the catalog PR.

[backryun]

Updated the lockstep bump to 0.155.0 — it is now the current npm latest (0.156.0-alpha.1 is still a pre-release). Same seven-file set (constant + Dockerfile + docs + golden + executor assertions); focused run 50/50. The earlier live smoke (32/33, every gated gpt-6-astra tier) was on the 0.154.0 revision of this same change.

[backryun]

Superseded by #14052 — same content, branch renamed to chore/codex-0.155.0 so the PR reflects the current pin. Closing this one to keep the review queue clean.