[codex] test cryptox AES-GCM helpers

[prettyboyvic]

Summary

• add focused AES-GCM/key parsing tests for internal/cryptox
• cover empty and non-empty round-trips, invalid base64/key lengths, random nonce behavior, tamper detection, wrong-key failure, and short blobs
• factor AES-GCM construction and random source access enough to exercise error paths without changing the encrypted blob format

Validation

• go test -coverprofile=cryptox_coverage.out ./internal/cryptox
• go tool cover -func=cryptox_coverage.out -> 100.0% statements

Notes

• Attempted go test ./internal/cryptox/... -race -cover, but local Windows Go requires cgo and this machine has no gcc in PATH. The non-race package tests pass with 100% coverage.

Closes #38