chore(codex): bump Codex CLI to 0.155.0

[backryun]

Summary

Bump the emulated Codex client fingerprint to the current @openai/codex release, in one lockstep change:

• src/shared/constants/codexClient.ts — DEFAULT_CODEX_CLIENT_VERSION 0.153.4 → 0.155.0
• Dockerfile — image install @openai/codex@0.155.0, kept in lockstep with the header fingerprint
• .env.example, docs/reference/ENVIRONMENT.md, docs/security/STEALTH_GUIDE.md — documented defaults/overrides
• tests/snapshots/provider/translate-path.json, tests/unit/executor-codex.test.ts — golden and header assertions

Split out of #12759 as requested in review: the catalog PR should not carry the client pin. Dropping the commit there left the pin at the deliberate #13026 value; this PR moves that pin forward in one coordinated bump instead, so the fingerprint OpenAI sees from the OAuth/Responses face matches the real client version installed in the image.

Supersedes #13815 — same content, branch renamed to chore/codex-0.155.0 so the PR reflects the current pin.

Validation

• node --import tsx/esm --test tests/unit/executor-codex.test.ts tests/unit/provider-translate-path-golden.test.ts — 50/50
• @openai/codex@0.155.0 is the current npm latest (0.156.0-alpha.1 is still a pre-release).
• Live Codex OAuth smoke passed on this revision (0.155.0) — all seven gated gpt-6-astra tiers (low/medium/high/xhigh/max/ultra + base) returned 200 through the ChatGPT/Codex backend; details and timings in the smoke comment below.
• The earlier 0.154.0 revision of this bump also passed a wider 33-model run (32×200; the single 400 was gpt-5.3-codex-spark, which upstream refuses for ChatGPT-account Codex regardless of client version).
• check:env-doc-sync is currently red on the clean tip for unrelated vars (OMNIROUTE_STRIP_SYSTEM_PREAMBLE, COMBO_LOOP_SAFETY_TIMEOUT_MS); nothing in this PR touches that contract.

[backryun]

0.155.0 live smoke — passed

Server built from this branch (DEFAULT_CODEX_CLIENT_VERSION = "0.155.0", no CODEX_CLIENT_VERSION override), single Codex OAuth connection. All seven gated GPT-6 Astra tiers requested back-to-back:

model	status	duration
gpt-6-astra	200	3.16s
gpt-6-astra-low	200	1.68s
gpt-6-astra-medium	200	2.26s
gpt-6-astra-high	200	1.73s
gpt-6-astra-xhigh	200	3.38s
gpt-6-astra-max	200	4.00s
gpt-6-astra-ultra	200	5.20s

No requires a newer version of Codex gate and zero errors in the run — this replaces the earlier 0.154.0 evidence with the current revision of the bump.

[backryun]

@diegosouzapw — fresh split-out of the Codex client pin (branch renamed from #13815; 0.155.0 is the current npm latest). Live smoke passed on this revision: all seven gated gpt-6-astra tiers returned 200 (details above). Ready for review when you have a moment.

[diegosouzapw]

Thanks @backryun — merging via the release merge-train. Validated in local merge-train (mt-train10c) on the devbox @ train tip 4d841aa1c740bbaa03868dc0a403c62099a99a42 with the 72 sibling PRs of this batch: typecheck:core, file-size, complexity, cognitive-complexity, changelog-integrity green; changed-area node:test 831/831 (0 failing) and vitest 480/482 — the two reds are autoCombo/provider-family-combos.test.ts timing out at 20s, which reproduces on the PURE release tip under the full vitest suite (and is already tracked by the Release-Green issue #13866), so it is inherited, not this batch's. Merged --admin per merge-gates §3/§4/§7.