Setup Codex Devcontainer

Adds Codex to a devcontainer already generated by the setup-devcontainer skill. This skill never edits devcontainer.json directly — the one exception is appending its own entries to the Capability Seam (runArgs), a designated extension point any CLI skill may idempotently append to, via a JSON-aware primitive distinct from the line-oriented one everything else here uses. It also idempotently ensures its own Network Manifest entry exists in .devcontainer/network-manifest.json, via the same JSON-aware primitive.

0. Security & Trust

This skill's generated automation touches three areas an external audit may flag. Each is opt-in, scoped to this container, and exists for a specific reason — none of it runs on the host, only inside the generated devcontainer.