[codex] Cover MCP proxy trace output

[Atomics-hub]

Summary

• factor the mcp-proxy-stdio implementation through an injectable IO helper
• add Unix test coverage proving --trace-out writes a hash-chain-verifiable event log on the operator path
• mark the CLI trace-out coverage in the roadmap

Verification

• cargo fmt --check
• cargo test mcp_proxy_stdio_trace_out_writes_verifiable_events -- --nocapture
• cargo test
• cargo clippy --all-targets --all-features -- -D warnings
• cargo run --locked -- release-audit