fix(agent): refresh mounted Codex credentials

[Cvv9]

What changed

• treat the mounted Codex auth file as authoritative on every agent-container start
• overwrite stale auth cached in persistent per-agent volumes
• fail closed when the mounted auth path is empty or not a regular file
• preserve 0600 permissions and node ownership without logging credential contents

Why

Production acceptance showed all nine hidden tasks were correctly routed and all agents were channel members, but seven services retained expired auth.json copies while Oracle and Lina had fresh copies.

Verification

• agent entrypoint syntax checked inside the production agent image
• root-to-node stale credential refresh passed with 0600 node:node ownership
• empty mounted credential fail-closed test passed
• git diff --check