security: require explicit grants for Codex ACP API billing

[miroslavb]

Summary

• make Codex ACP subscription-only by default through a dedicated managed CODEX_HOME
• strip ambient API credentials and unsafe adapter bypass overrides from ACP and worker-MCP children
• require both a task billing.api_grant request and an exact active operator grant before exposing OPENAI_API_KEY
• validate grant scope, provider, model allowlist, expiry, revocation, file ownership and permissions; terminate the key-bearing child at expiry
• emit secret-free authorization receipts and document the operator workflow
• preserve upstream per-role reasoning controls through a sanitized CODEX_CONFIG

Why

ACP workers inherited the parent environment, so a production API key could be used even when the intended path was a ChatGPT subscription. This change makes API billing fail closed and auditable, while keeping an explicit break-glass path for approved tasks.

Verification

• 235 passed, 7 skipped
• ruff check passed
• mypy passed