Codex CLI provider adapter: invocation, event mapping, usage, blocker detection

[Ryan-Atkinson87]

Implement ProviderAdapter for the Codex CLI behind the existing interface (#16). Resolves, for Codex, the §15 open item deferred until a second provider was wanted: per-provider event mapping, usage extraction, and blocker detection.

Spec §3.1 (adapter interface), §3.2 (Codex row — non-interactive CLI, --output-format json, token efficiency), §3.3 (build order + MVP note).

Acceptance criteria

• run_session(...) invokes the Codex CLI non-interactively with --output-format json (§3.2).
• Event mapping: Codex JSON stream → NormalisedEvent (reasoning / tool-call / tool-result / output) so the UI streams live progress identically to Claude (§3.1).
• Usage extraction: tokens in/out, cost, model, duration → UsageReport (§3.1).
• Blocker detection: maps Codex output to outcome: completed | blocked | error (§3.3 note).
• artifacts derived from git, not provider self-report (§3.1).
• No Codex-specific calls leak outside this adapter — orchestration talks only to ProviderAdapter (§3.3).
• Uses the resolved per-role model string passed in; no model mapping inside the adapter (§3.1).
• Every CLI invocation has explicit success and failure paths — no silent failure.
• Unit tests with recorded Codex JSON fixtures cover each event type, usage extraction, and the blocked/error outcomes.

Depends on: #16, #9, #4