Add Codex LLM provider

[spalen0]

Summary

• add a native OpenAI Codex SDK LLM provider with read-only, deny-all, ephemeral turns
• wire LLM_PROVIDER=codex into the provider factory with optional Codex auth reuse
• add docs, env examples, optional dependency lock updates, and focused tests

Tests

• uv lock
• uv run --extra dev ruff check utils/llm/codex_provider.py utils/llm/factory.py tests/test_llm.py
• uv run --extra dev pytest tests/test_llm.py -q
• git diff --check