feat(codex): SessionMutator stub + session-file resolver

Wires the host's mirror hook end-to-end: FindCodexSessionFile walks
~/.codex/sessions/<YYYY>/<MM>/<DD>/rollout-*-<thread_id>.jsonl to
prove the path for the captured thread_id, then logs the no-op.

Real rewrite is deferred to v2: codex keys tool calls by `call_<id>`
not the `toolu_<id>` Plexum's canonical block format uses, so a v1
rewriter would never find a matching id. When tool-call id round-trip
through codex's native surface lands, the rewriter plugs into this
file's path resolver.

Also rescues cmd/plexum-openai-provider-plugin/main.go from .gitignore
(the bare 'plexum-openai-provider-plugin' pattern was too greedy — it
matched the source directory). Tightened to '/plexum-openai-provider-plugin'
+ '/bin/' so only built binaries get ignored.

.gitignore

@@ -1,4 +1,4 @@
-plexum-openai-provider-plugin
 /plexum-openai-provider-plugin
+/bin/
 *.tmp
 dist/