feat(observer): add codex_sidecar runtime for ChatGPT Pro (#1225)

## Description
Adds a `codex_sidecar` observer runtime so **Codex / ChatGPT Pro** users get observer-based memory extraction with **no API key** — auth is delegated to the local `codex` CLI (`codex exec`), not handled in codemem. Mirrors the existing `claude_sidecar` runtime.

Validated end-to-end on a real ChatGPT Pro login: a live `codex exec` spawn returned output with **zero recursion** (codemem hooks do not fire under `--ignore-user-config`).

- Shells `codex exec --ephemeral --ignore-user-config --skip-git-repo-check -s read-only [-m <model>] -o <tmpfile> -` with the prompt on stdin; reads the final message from the `-o` temp file (cleaned up in `finally`).
- **Tier routing:** selected model passed via `-m`; on a model-unavailable error, retries once without `-m` and reports the fallback (same pattern as `claude_sidecar`).
- **Recursion-safe:** `--ignore-user-config` + `CODEMEM_PLUGIN_IGNORE=1` and viewer suppression in the child env; `CLAUDE_CODE_*` markers scrubbed.
- **Auto-default** to `codex_sidecar` only when no `observer_runtime`, no API key from any provider, no usable OpenCode OAuth cache, the `codex` CLI is resolvable, and `~/.codex/auth.json` exists. Otherwise opt in via `observer_runtime`/`CODEMEM_OBSERVER_RUNTIME=codex_sidecar`.
- `ObserverAuthError` on auth failure (anchored classifier to avoid false positives on operational log noise); redacted error logging; timeout + maxBuffer caps; file-output honored even when our own kill (timeout/buffer) fired.
- Config: `codex_command` / `CODEMEM_CODEX_COMMAND` (default `["codex"]`).
- Docs: observer auth modes updated for `codex_sidecar`.

`claude_sidecar` and `api_http` behavior are unchanged.

> Stacked on #1224 (early-beta Codex docs); base retargets to `main` when that merges.

## Type of Change

- [x] 🚀 Feature (new functionality)
- [ ] 🐛 Bug fix (fixes an issue)
- [ ] 📚 Documentation (docs-only change)
- [ ] 🔧 Maintenance (refactor, chore, CI, etc.)
- [ ] 🧪 Testing (test-only changes)

## Testing

- [x] Relevant checks pass locally (`pnpm run tsc`, `pnpm run lint`, `pnpm run test` — 2239/2239)
- [x] Added/updated tests (model passing, fallback, auth/model classifiers + boundary cases, skip-init, and a real fake-`codex` subprocess covering env scrubbing, stdin, `-o` capture, cleanup, and redaction)
- [x] Manually verified a real `codex exec` observe call on a ChatGPT Pro login (output returned, no recursion)

## Checklist

- [x] Code follows project style (`pnpm run lint` passes for touched files)
- [x] Self-review completed + CodeReviewer pass (Important findings addressed)
- [x] Documentation updated (docs/plugin-reference.md observer auth modes)
- [x] No new warnings introduced