Add controlled Codex qualification workflow

[KeyffMS]

Summary

Adds the dedicated live Codex qualification entry point requested for the trusted self-hosted runner.

• trigger: workflow_dispatch only;
• hard guard: executes only when dispatched from main;
• Environment: plananvil-codex;
• runner labels: [self-hosted, linux, x64, plananvil, codex];
• no PR or untrusted-code trigger;
• creates a disposable workspace with plananvil-qualification-workspace;
• runs a minimal read-only smoke task through codex exec --ephemeral;
• verifies the expected marker and that the workspace Git status is unchanged.

After this PR is green and merged, the workflow can be manually dispatched from main to verify the runner and Codex runtime.