feat: Plexum-openai-provider v0.1 — OpenAI codex CLI as backend

Plexum ProviderPlugin that wraps the local `codex` CLI binary
(OpenAI Codex CLI ≥ 0.135). Same CLI-driven pattern as
Plexum-gemini-provider and Plexum-anthropic-provider's contractor.

internal/runner/ (~200 LOC):
- Per Plexum turn, fork:
    codex exec [resume <thread_id>] \
      --skip-git-repo-check \
      --dangerously-bypass-approvals-and-sandbox \
      --json \
      [--model <m>] \
      "<last user msg>"
  in agent workspace, with stdin = /dev/null (codex would otherwise
  block waiting for additional input).
- Stream-parses JSONL events:
    thread.started        → save thread_id to .plexum-codex-session
    item.completed        → if type==agent_message, emit text_delta
    turn.completed        → capture usage (input/output/cached/reasoning)
    error / turn.failed   → emit canonical EventError
- Other event types (turn.started, item.started, reasoning, etc.)
  logged at debug, don't produce user-facing events for v1

cmd/plexum-openai-provider-plugin/ implements ProviderPluginWithAgent
(needs AgentContext.Workspace as cwd).

Model surface:
  default: ["codex"]  (no --model flag → CLI default; only thing
                       ChatGPT-account installs support)
  override via config.supported_models + config.model_args for
  API-key installs that want gpt-5 / o3 / etc.

HostConfig (all optional):
  binary           default "codex" (operator should set abs path for
                   systemd PATH)
  extra_args       appended before the prompt
  supported_models override the advertised model list
  model_args       map plexum id → CLI --model value

No api_key field — codex CLI handles auth via ~/.codex/ state
(ChatGPT login OR OPENAI_API_KEY env).

End-to-end verified against local install (ChatGPT login):

1. CLI turn 1:        "OpenAI built me."
2. CLI turn 2 (resume): "I said: 'OpenAI built me.'" (multi-turn ✓)
3. Fabric channel e2e: alice → cx agent → codex CLI → outbound REST →
   seq=23: "Use list comprehensions for concise, readable filtering and
            transformation of iterables."

Known: when daemon runs under systemd PATH doesn't include nvm/local
bin dirs; operator must set absolute binary path in config.json.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

scripts/install.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+# Plexum-openai-provider installer.
+#
+# Builds + installs the plugin under ~/.plexum/plugins/. Plugin wraps
+# the local `codex` CLI; auth lives in the CLI's own ~/.codex/ state.
+set -euo pipefail
+
+REPO="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
+PROFILE_DIR="${HOME}/.plexum"
+
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --profile) PROFILE_DIR="$2"; shift 2 ;;
+        -h|--help) sed -n '2,/^set -euo/p' "$0" | sed -n '/^#/p' | sed 's/^# \{0,1\}//'; exit 0 ;;
+        *) echo "unknown flag: $1" >&2; exit 2 ;;
+    esac
+done
+
+log() { printf '\033[1;34m[openai-install]\033[0m %s\n' "$*"; }
+command -v go >/dev/null || { echo "go not found on PATH" >&2; exit 1; }
+command -v codex >/dev/null || log "WARN: codex CLI not on PATH yet — operator must install + 'codex login' before first turn"
+
+PLUGIN_DIR="${PROFILE_DIR}/plugins/plexum-openai-provider"
+mkdir -p "${PLUGIN_DIR}"
+
+cd "${REPO}"
+VERSION="$(git describe --tags --always 2>/dev/null || echo dev)"
+LDFLAGS="-X main.Version=${VERSION}"
+log "building plexum-openai-provider-plugin (v=${VERSION})"
+CGO_ENABLED=0 go build -ldflags="${LDFLAGS}" \
+    -o "${PLUGIN_DIR}/plexum-openai-provider-plugin" \
+    ./cmd/plexum-openai-provider-plugin
+
+cat > "${PLUGIN_DIR}/manifest.json" <<'EOF'
+{
+  "name": "plexum-openai-provider",
+  "version": "0.1.0",
+  "activation": "lazy",
+  "executable": "plexum-openai-provider-plugin",
+  "contracts": {
+    "provider": {
+      "models": ["codex"]
+    }
+  }
+}
+EOF
+
+cat <<EOF
+
+[openai-install] done.
+  plugin binary: ${PLUGIN_DIR}/plexum-openai-provider-plugin
+  manifest:      ${PLUGIN_DIR}/manifest.json
+  models:        codex (CLI default — ChatGPT login restricts model selection;
+                 add others via config.supported_models if on API key)
+
+Optional config: ${PLUGIN_DIR}/config.json
+  {
+    "binary": "codex",                     // absolute path required under systemd
+    "extra_args": [],
+    "supported_models": ["codex"],
+    "model_args": {"gpt-5": "gpt-5"}       // map plexum id → --model value
+  }
+
+No api_key needed — codex CLI handles auth via ~/.codex/ state.
+
+Next steps:
+  1. .plugins.allow += ["plexum-openai-provider"] in ${PROFILE_DIR}/plexum.json
+  2. plexum agent-add --model codex <agent-id>
+  3. systemctl --user restart plexum
+EOF