docs(codex): clarify bridge account selection

[drewstone]

What changed

Document that each cli-bridge process serves the Codex account selected by its CODEX_HOME, and that codex must be enabled in that process's BRIDGE_BACKENDS.

Why

A Runtime proof sent codex/gpt-6-luna to bridge port 8900, which used /home/drew/.codex-lane and returned workspace routing discovery unauthorized (401) before inference. The account's access token was expired; the exact account-side reason for the 401 is not independently proven. The healthy GLM bridge on port 3355 did not enable Codex. Current-main bridge code completed the same maintained Runtime composition on an isolated Codex-enabled port 3399 using an active account, so the source invocation path did not need a code change.

Verification

• Real streamAgentTurn → bridge → native Codex completed RUNTIME_CODEX_SUBSCRIPTION_OK with 10,152 input and 12 output tokens; dollar cost unknown. Bridge run bridge-run-88a48736-fcd0-4e45-b99c-be5f9d2b269a is terminal done, with retained replay.
• A separate dispatched Runtime cancellation reached bridge run bridge-run-3c02cb4f-e43e-4fcf-8cc8-b8c82b21f981, terminal cancelled in about four seconds. No Codex child remained; active and in-flight counts were zero.
• pnpm build passed. Focused Codex tests: 26 passed. Runtime consumer check passed. Full pnpm test: 1,213 passed, 12 skipped, one Pi real-child test timed out at five seconds during shared host load; that test passed alone in 528 ms.
• Independent read-only review found no issue in the changed documentation. It noted a pre-existing codex/default config inheritance issue outside this explicit-model route.

Proof artifacts: /home/drew/.local/state/fleet/recovery/session-recovery-20260926/cli-bridge-codex-proof/ (private local path; no credential values in the PR).

[tangletools]

✅ Auto-approved PR — ee91f3c6

Blanket team auto-approval is intentional. The merge gates are CI and codex-p1.
No automated review runs on this PR. This approval rests on the rule above alone.

_{tangletools · auto-approval · reason: blanket_auto_approve · 2026-09-27T10:41:49Z}