Typed observe/materialize/read-back for ProvisionCodexRuntime; delete host_codex_runtime_provision_script.dag

[gunbai-bot]

Summary

• Replaces the hand-rolled bash body of ProvisionCodexRuntime (concat-built if/grep/printf receipt markers) with three typed single-command argv steps in host_effect_realize.dag: observe (--version), materialize (gunbc.Cli.Run against materialize_codex_runtime_on_local_host), and a mandatory read-back that re-runs observe and must independently satisfy the version-identity marker before the reconciliation converges — never "we issued the install therefore it is installed".
• LocalShell dispatches through the existing typed argv services (gunbc.WitnessBin.Run / gunbc.Cli.Run); SshShell/FleetSsh route the same argv shapes through run_typed_argv_transport. All branching (does the version match? did materialize fail?) is decided in .dag over typed exec results (exit code, stdout), not shell text markers.
• codex_runtime_observe_argv moved from host_codex_runtime_provision.dag to host_codex_runtime_provision_verdict.dag to avoid a host_effect_realize -> host_codex_runtime_provision -> host_toolchain_ensure -> host_effect_realize import cycle.
• The standalone mkdir-release-parent argv step is dropped as redundant: materialize_codex_runtime_bundle's own call chain (release_codex_runtime_bundle_immutable) already runs shell.Mkdir.Parents on release_parent.
• dag/gunbc/host_codex_runtime_provision_script.dag is deleted in this same cut — per DESIGN.md's replacement-migration doctrine (one vertical, no dual authority, delete-first).
• Updated docs/plans/shell-to-dag-residual-census-and-arc-completion.md rows to reflect this cutover as LANDED.

Test plan

• dag/gunbc/host_effect_realize.dag typechecks cleanly (verified by remote claim_batch resolve/typecheck pass).
• All 10 test fns in the rewritten dag/test/claim/host_codex_runtime_provision_design_witness_test.dag PASS, green-by-execution via claim_batch --hermetic (not just typecheck/grep):
  • design_witness_realize_carries_scaffold
  • design_witness_identity_mismatch_refuses_fail_closed
  • design_witness_identity_ok_converges
  • design_witness_materialization_failed_refuses_fail_closed
  • design_witness_transport_refused_refuses_fail_closed
  • design_witness_host_unsupported_refuses_fail_closed
  • design_witness_routes_through_host_effect_apply
  • design_witness_default_effect_is_codex_runtime
  • design_witness_toolchain_kind_maps_to_effect
  • design_witness_srv1_bundled_executable_under_release_root
• Grep sweep confirms no remaining reference to the deleted module outside historical/documentation prose noting it as deleted.
• CI reality note: hermetic replay means the argv transports are never live-executed in CI; this PR's evidence is the design-witness suite above plus typecheck, per the parent brief.