integration: migrate Codex normalization onto hookkit without behavior change

[SignalLayerLabs]

Context

The Claude Code/OpenCode work extracted engine-independent hook logic into marginal.integrations.hookkit. The integration overview explicitly leaves Codex migration as separate follow-up work so the validated Codex path is not destabilized.

Goal

Remove duplicated engine-independent Codex normalization by migrating it onto hookkit without changing public behavior or authority.

Acceptance criteria

• Existing Codex lifecycle, privacy, fail-open and Earned Enforcement tests remain green.
• No capability broadening: Codex stays Tool Enforcement, not Full Compute Enforcement.
• Preserve action/session correlation and existing ledger semantics.
• Add characterization tests before moving behavior.
• Rebuild deterministic Codex runtime/provenance artifacts required by the repository.
• Document compatibility impact (expected: none).