Support Codex desktop authentication through a shared guest keyring

[hbrodin]

Summary

Desktop Remote SSH starts Codex outside the terminal wrapper, so it previously could not reliably reach the unlocked guest keyring. Share a systemd-managed user bus and GNOME Keyring across desktop and terminal sessions, with coop codex-unlock for explicit initialization, unlock, and native server recovery.

• Keep credentials in the encrypted guest keyring; preserve migration/reboot barriers and refuse conflicting or unsupported stores.
• Default guest Codex sessions to full access because the VM is the isolation boundary. Preserve explicit desktop/user settings, and make --ask restore workspace sandboxing and on-request approvals.
• Fix Firecracker session startup: recreate linger state after the base image's tmpfs mount and add missing SSH PAM session registration without replacing the existing PAM stack. Upgrade older guests through codex-unlock.
• Document SSH host setup, manual desktop connection steps, permissions, migration, and troubleshooting; add installer and real app-server regressions.

Related to #480. Includes the terminal-auth prerequisite from the still-open #482.

Validation

• Full Firecracker integration on hb@100.109.126.112: 482 passed, 0 failed, 8 skipped; Linux bridge-isolation gate passed.
• Final Firecracker setup/auth/migration regression after upgrade-review fixes: 27 passed, 0 failed, 0 skipped.
• Final Lima integration: 252 passed, 0 failed, 12 skipped, including both missing-session-support upgrade cases and reboot barriers.
• cargo build --workspace --release, workspace clippy with -D warnings, format and diff checks passed.
• Workspace tests passed with the known unrelated macOS non-UTF8 filename test excluded.
• Python installer, account-wrapper, and integration-probe regressions passed. Installer assertions were mutation-checked; the earlier lifecycle mutation sweep had 90 caught, 12 unviable, and no missed mutations.
• Independent review covered correctness, design, conventions, security, API usage, tests, docs, and comments; findings fixed and final review clean.

The user confirmed desktop login works on Lima. Real-account token refresh/logout concurrency and a complete desktop-to-Firecracker UI/OAuth workflow were not verified. Lima --full was not run. Existing desktop threads retain their explicit permission selection and may need Full access selected manually.