[codex] Track project Codex config safely

[austinkennethtucker]

Summary

• Add a minimal tracked .codex/config.toml scaffold for repo-local Codex project configuration.
• Replace the broad .codex/ Git ignore with a narrow allow-list for .codex/config.toml and one-level .codex/rules/*.rules files.
• Update repo hygiene checks and tests so Codex auth/state files, sessions, caches, unknown .codex files, and nested rule paths remain blocked.

Why

Codex supports project-scoped .codex/config.toml files in trusted repositories, but this repo also needs a strict boundary between shareable project config and local Codex/ChatGPT credentials. This keeps project config shareable while preserving the existing data/codex-home auth boundary.

Validation

• python3 scripts/check_repo_hygiene.py
• PYTHONPATH=. .venv/bin/pytest -q tests/test_repo_hygiene.py
• Previously run before commit: full pytest suite, both compose security checks, compileall, and TOML parse for .codex/config.toml.

Notes

The PR intentionally leaves .dockerignore excluding .codex, so project Codex settings can be shared in Git without entering the Docker image build context.