feat(start): share Codex sessions across isolated providers

[SaladDay]

cc-switch start codex uses temporary homes, so parallel providers cannot share durable native session history. Add opt-in --shared-sessions to give each provider private credentials/configuration while sharing persistent history and Codex's session locks.

cc-switch start codex team --shared-sessions
cc-switch start codex plus --shared-sessions

Persistent provider homes keep recorded rollout paths valid after exit. Shared storage and the selected provider remain effective when resuming or loading project settings. Login capture updates only the selected provider's authentication; local refreshes survive forced termination, and explicit credential edits in cc-switch take precedence over exit capture and on the next launch.

Scope is limited to the Codex CLI launch path, an auth-only capture operation, focused tests, and documentation. Default temporary launches, TUI behavior, other apps, proxy routing, and the database schema retain their existing behavior.

Validation:

• The new module unit tests (4) and subprocess integration tests (9) passed, including concurrent launches, credential isolation, normal/interrupted/forced exits, restart, explicit credential edits, relative paths, native background children, launcher-only termination, and default launches.
• Native Codex 0.153.4 verified with isolated copies of real local sessions: listing, cross-provider continuation, active-writer exclusion, restart, rename, archive/unarchive, and deletion. Original session hashes remained unchanged.
• Local HTTP test providers verified actual request endpoints and corresponding fake credentials. Native configuration tests also covered trusted project overrides; interactive TUI resume was checked separately. Both the raw binary and the installed launcher retained provider exclusion after launcher-only SIGKILL.
• Rust CI passed: 4,329 library tests (2 ignored), 10 binary tests, the selected proxy integration tests, Linux/Windows library-only builds, and the Windows CLI build. Benchmark CI also passed. Local full-suite runs showed a failure in the unchanged session_usage_codex::tests::test_incremental_resume_keeps_replay_prefix_alignment; that test passed in isolation, alongside the new unit tests, and in CI. This local discrepancy remains recorded; statistics code is unchanged.
• cargo fmt --check, diff checks, and the library-only check/test compilation with warnings denied passed. Standard Clippy encounters the pre-existing reversed_empty_ranges error in home_chart.rs; Clippy with that existing lint allowed passes.

Three independent two-reviewer blind rounds were followed by two fresh single-reviewer rounds as findings converged. The final review found no actionable issues. Reviewers received the goal, acceptance criteria, and scope, without the implementation explanation or previous findings.

This option targets macOS/Linux. Only one shared launch per provider is allowed at a time, and native thread writer locks still apply. Older official history uses the existing optional migration. Native credential environment variables retain their existing precedence. Real Team/Plus OAuth refresh and upstream acceptance of cross-provider encrypted reasoning were not tested.

Refs #436