Fix terminal Codex login reusing an unusable desktop keyring session

[hbrodin]

Summary

ChatGPT-mode terminal Codex could reuse a desktop app-server whose D-Bus keyring session was unusable, even after the terminal wrapper successfully unlocked its own keyring. The wrapper now prepends -c 'cli_auth_credentials_store="keyring"', preventing implicit daemon reuse in Codex 0.153.0 and 0.154.0. This also covers codex-yolo, preserves caller argument precedence and API-key passthrough, and keeps encrypted credential storage.

Adds CI tests for wrapper arguments and an opt-in regression using a real app-server on a separate unusable keyring session. The regression verifies that removing the override restores daemon reuse. Documentation explains the version-dependent behavior and how to run the test. Desktop session management remains outside this change.

Fixes #481.

Validation

• Real-daemon and wrapper regressions: all 3 tests passed with Codex 0.153.0 and 0.154.0.
• Existing integration-probe regressions: all 9 tests passed.
• Shell syntax and git diff --check: passed.
• All eight review lenses completed. Fixed the test cleanup race found during review; restoring the old cleanup causes its regression assertion to fail. No code findings remain.

Remaining gates

Draft pending required validation. Rust build/format/clippy/unit checks were not run because Cargo is unavailable. Lima and Firecracker VM integration suites were not run because neither backend is available here. The local pre-commit hook was bypassed for this commit because prek is unavailable. CI runs the wrapper tests; the real-daemon regression is opt-in and does not complete either VM gate.