[codex] Integrate CodeGraph into issue workflows and modularize platform

[JASON-QWeb]

What changed

• Refactored the configuration, persistence, tool-gateway, workflow, settings-console, and task-queue code into focused modules with expanded regression tests.
• Replaced the GitNexus indexing path with the real upstream @colbymchenry/codegraph@0.9.3 CLI integration.
• Made the issue workflow initialize CodeGraph for the first Issue on a repository, persist only a clean-baseline database in ignored platform-side data/codegraph/<owner>--<repo>/codegraph.db, restore it for later Issue sandboxes, and run upstream codegraph sync --quiet instead of rebuilding a new database.
• Corrected baseline refresh semantics: a restored database is synchronized through CodeGraph's content-hash scan so files already changed in clean, newly cloned base branches are detected; after agent edits, a separate working-tree sync refreshes only the task-local graph and never promotes unmerged code into the shared cache.
• After initialization or sync, the workflow runs upstream codegraph context --format json and injects the resulting graph/code context into ContextPack before planning and implementation.
• Added read-only codegraph.query and codegraph.context gateway tools, artifacts/events for graph creation and task context, and repository-level configuration with fail_on_error: true.
• Updated runtime repository binding for JASON-QWeb/CodeZero, platform configuration, operator documentation, coverage support, and ignored local index/environment/build output.

Why

An Issue-driven agent should not start planning or editing with only an ad hoc source scan, and it should not rebuild an unchanged repository graph for every Issue. CodeGraph's normal Git fast path sees working-tree changes but not a stale cache versus a new clean checkout, so the workflow now deliberately reconciles shared baseline caches by file hashes, keeps task-branch edits local, and supplies task-specific CodeGraph context to the agent for quicker navigation and better-scoped pull requests.

Validation

• pnpm check passed: lint, typecheck, coverage test run, and production build.
• Targeted CodeGraph/workflow tests passed (tests/codegraph-indexer.test.ts, tests/repo-navigation-graph.test.ts, tests/config-loading.test.ts, tests/issue-workflow.test.ts, tests/tool-gateway.test.ts).
• Runtime-verified two independent fresh task sandboxes using the upstream CLI: the first invoked codegraph init ... --index, while the second restored the platform cache and invoked codegraph sync ... --quiet.
• Reproduced the stale-clean-clone case with an indexed base commit followed by a committed new function: normal upstream Git-path sync did not find it, while the integrated hash-scan sync found it.
• Runtime-verified a sandbox-only function becomes queryable after post-implementation sync and remains absent from a later clean sandbox restored from shared cache.
• Confirmed .env, sandbox .codegraph/, platform data/codegraph/, dependency directories, caches, build output, coverage output, and .DS_Store remain ignored and are not part of the commit.
• Scanned the committed scope for common token/private-key patterns with no credential findings.