feat(codex): land native audit+fix skill with self audit hardening

[GiulioDER]

Summary

1. I added a native Codex audit+fix skill with parallel specialist agents and deterministic verification.
2. I ran CCA against its own implementation and fixed all six confirmed findings.
3. I made Codex skill installation transactional, rejected link redirects, required all agent prompts, and gated commands from untrusted HUNT targets.
4. I added regression coverage for installer conflicts, partial updates, rollback failure, missing prompts, and unsafe repository execution.

Verification

1. Full suite: 654 passed, 1 skipped.
2. Ruff passed.
3. Pyright reported zero diagnostics.
4. Differential review classified all 17 hunks SAFE.
5. Final architect review returned APPROVED.
6. A clean wheel installed all 18 payload files, including 13 agent prompts.

Context

PR #41 merged into its stacked base instead of master. This PR lands both the native Codex integration and its self audit fixes directly on master.