feat(codex): bind a checkout to an existing Scope

[knqiufan]

Which issue or RFC does this PR close?

Closes #1759. Follows RFC 1345's server-owned Scope identity and explicit workspace binding contract.

Rationale for this change

Codex can select one process-wide Scope or freeze the current Session, but it lacks the checkout binding command already available in Claude Code and WorkBuddy. Without it, new sessions in separate projects fall back to Default; MCP set_scope_binding only changes the current Session.

What changes are included in this PR?

• Add bind_scope, clear_scope_binding, --bind-scope, and --clear-scope to the Codex scope script. The stored key uses integration=codex, kind=workspace, and the existing Git-root path hash.
• With only --cwd, print the effective directory Scope without writing a Session binding. Bind an existing server-assigned Scope; never create a Scope or derive its ID from a path, remote, or branch.
• Document the commands in both integration guides and route checkout-binding requests from the Skill entry point. Explain plugin path discovery, clearing, and verification when an explicit Scope variable overrides the workspace binding.
• Add a real HTTP/SQLite service-chain test invoking the CLI and hook subprocesses. Cover Git-root/subdirectory readback, repository isolation, old/new sessions, explicit Scope precedence, invalid Scope rejection, mutually exclusive flags, repeated clearing, retained Session bindings, and unchanged Scope records.

Are there any user-facing changes?

Users can persist a checkout to an existing Scope for later sessions. POWERCONTEXT_CODEX_SCOPE_ID retains precedence, and existing Session bindings remain intact. MCP binding tools still target the current Session. No API or persisted-format changes.

How was this change tested?

• With loopback requests bypassing the local proxy: uv run pytest -q tests/codex_plugin tests/e2e/test_codex_service_chain.py — 242 passed, 6 skipped.
• uv run prek run -a with PREK_SKIP=ty-check — passed; type checking ran separately below.
• uv run ty check --python-platform linux --exclude docs/my — passed. Default local type checking includes unrelated untracked research scripts and Linux-only APIs on Windows.
• uv lock --check and git diff --check — passed.

The service-chain test uses the real HTTP server and SQLite with direct CLI/hook invocation; it does not establish acceptance inside the real Codex UI or against OceanBase.

AI usage statement

Grok 4.7 assisted with implementation, tests, and documentation. OpenAI Codex assisted with review, Skill guidance, service-chain coverage, and validation.

[Alanxtl]

lgtm