Route Codex runner diagnostics through approved qualification workflow

[KeyffMS]

Summary

The standalone diagnostics workflow was rejected by the self-hosted runner administrator hook before any diagnostic step ran:

PlanAnvil runner policy denied this job: workflow file or workflow ref is not allowed

This change keeps the runner policy intact and routes diagnostics through the already-approved .github/workflows/plananvil-codex-qualification.yml workflow.

Changes

• add diagnostics to the existing qualification workflow mode choices;
• run the 14-variant diagnostic matrix only when mode=diagnostics;
• keep diagnostics non-gating with respect to C01-C16 and the release gate;
• remove the standalone diagnostics workflow that the runner allowlist rejects;
• update regression tests to assert that diagnostics use the approved workflow file and remain main-only/self-hosted/sanitized.

Safety

No change to runner policy, no approval/sandbox bypass, no privilege expansion, and no weakening of the release gate.