[AIGTWY-4882] Cover OS-managed input preservation in CUJ7 at Claude/Codex parity

[tt-le]

Summary

Stacked on #930. Adds the CUJ7 coverage #930's headless cases cannot reach, and keeps CUJ7 at Claude/Codex parity. Tracks AIGTWY-4882.

ug only rewrites an agent's OS-managed file when it has a TTY: managed_writes_allowed() is sys.stdin.isatty() (src/ucode/managed_files.py). Both _reconcile_managed_settings (Claude) and _reconcile_managed_config (Codex) return early unless ug's desired settings conflict with the file, and a missing owned path is not a conflict. UserSession.run starts children with stdin DEVNULL or a pipe, so every headless case covers only the no-write path. No test asserted that the interactive rewrite keeps pre-existing admin input.

CUJ7 now collects twelve cases, six per agent:

Journey	Claude	Codex
Configured discovery	case 07	case 08
Fresh --model-location task ×2	✓ (#930)	✓ (#930)
Headless: preserves OS-managed input ×2	test_ug_claude_preserves_preexisting_managed_family_defaults (#930)	test_ug_codex_preserves_preexisting_managed_config (new)
TUI: ug rewrites the file, keeps input, revert restores	test_ug_claude_tui_rewrites_managed_settings_preserving_family_defaults (new)	test_ug_codex_tui_rewrites_managed_config_preserving_admin_settings (new)

Shared fixture and assertions. #930's family_defaults fixture is now an agent-keyed managed_input fixture. It seeds /etc/claude-code/managed-settings.json with distinct family defaults, or /etc/codex/managed_config.toml with inert admin settings outside ug's owned keys: a sibling AdminProvider model provider and file_opener. Teardown is unchanged: recording stops, then the guarded revert, file removal and parent-directory cleanup (only if the fixture created the directory) run. Every preservation case requires:

• each seeded leaf unchanged, via a recursive _assert_contains;
• task-correlated, nonempty HTTP 200 inference through the recorder, via assert_inference_evidence (Codex also with databricks-model-service-parent-schema = ug_e2e.models, plus a completed turn reporting the scoped Luna service; Claude headless also checks modelUsage);
• for the TUI cases, ug's gateway base URL in the rewritten file (env.ANTHROPIC_BASE_URL / model_providers.Databricks.base_url = <recorder>/ai-gateway/{anthropic,codex/v1}). This proves the interactive write happened.
• for the TUI cases, ug revert must restore the parsed seeded document. Revert may reserialize the file, so the comparison is on parsed JSON/TOML, not bytes.

Both READMEs now describe CUJ7 as eight journeys and twelve cases, and the scenario table has rows for the three new cases.

Not asserted, intentionally. Codex strips a pre-existing model / model_reasoning_effort from the managed file when no model is chosen. That is the opposite of Claude's family-default preservation, and the CUJ seed avoids those keys. See the comment below; it's a product question, not something to lock in here.

Validation

• All e2e_cuj cases collect (90), including 12 CUJ7 cases, with --confcutdir=tests/e2e_cuj and pexpect/pyte, matching CI.
• Offline sanity check of the new helpers: each seed parses, _assert_contains accepts ug's additions and rejects a changed or missing seeded leaf, and _assert_rewritten rejects a file ug did not write.
• ruff check and ruff format --check pass on tests.
• Unit suite: 3,518 passed. The two failures are tests/test_e2e_user_agent.py::TestClaudeUserAgent::{test_user_agent_arrives_at_gateway,test_managed_http_header_arrives_at_gateway}, which also fail on origin/main on the authoring host: it has its own /etc/claude-code/managed-settings.json. They pass in CI.
• Live CUJ7 has not run for the new cases. The host's managed settings make a local live run unrepresentative, and ci.yml only triggers on PRs targeting main, so this stacked PR gets no automatic CUJ run. It will run once [AIGTWY-4882] Add fresh-launch journeys and dedicated CUJ7 coverage #930 merges and this PR retargets main, or via a manual integration.yml dispatch on this branch.

This pull request and its description were written by Isaac.

[tt-le]

Product question (not addressed in this PR): Codex strips an admin's managed model, while Claude preserves family defaults.

On an unmanaged launch with no model chosen, Codex's compose (src/ucode/agents/codex.py, write_tool_config) runs base.pop("model") and base.pop("model_reasoning_effort"). _reconcile_managed_config applies the same compose to /etc/codex/managed_config.toml, so a pre-existing admin model there is removed whenever ug rewrites the file (any TTY launch). This is intended today: tests/test_agent_codex.py::test_managed_config_preserves_other_keys seeds model = "my-own" and asserts it's gone ("ucode removes its stale model pin"), introduced in #429.

Two things look inconsistent:

1. Claude does the opposite. With no CodingAgentConfig, should_preserve_preexisting_claude_family_defaults treats an existing family default in the OS-managed file as belonging to the developer and keeps it.
2. The "stale pin" framing doesn't match the test. The test seeds a value ug never wrote. Also, model_reasoning_effort isn't in Codex's MANAGED_KEYS, so ug removes a key it doesn't claim to own.

This PR's Codex cases deliberately seed only keys outside ug's owned paths, so they neither lock in nor contradict the current behavior. If the intended behavior is to preserve admin-set model / model_reasoning_effort when ug never wrote them (parity with Claude), that's a product change plus a unit-test update. A CUJ7 assertion can follow once it's decided.