feat(codex): harden restricted and resumable execution

[urd00m]

This PR hardens and extends the Codex model backend for normal and restricted execution. It enables Codex built-in tools by default, retains an explicit MCP-only restricted mode, safely carries filtered Codex session state between Ray workers, records structured terminal and usage telemetry, continues max-output sessions, and retries transient model-capacity failures with capped exponential backoff and jitter.

Compatibility notes:

• Codex built-in tools are now enabled by default; pass allow_builtin_tools=False to retain the restricted MCP-only mode.
• Restricted mode still disables ambient capabilities, isolates the Codex working directory, and exposes only explicitly supplied Chia MCP methods.
• Chia does not automatically widen the sandbox when built-ins are enabled; callers combining built-ins with HTTP Chia tools must select a network-capable sandbox.
• Dangerous sandbox bypass is rejected when built-in tools are disabled.
• Python 3.10 installs tomli to read Codex configuration.
• Resumable bundles use manifest version 2 and require compatible absolute session roots across workers.

Tests:

• pytest -q chia/models/tests/test_codex.py — 71 passed, 5 skipped
• pytest -q chia/models/tests — 350 passed, 132 skipped

Related PRs / Issues:
None.

Type of change:

• Bug fix
• New feature
• Other enhancement

Impact:

• Core Chia change (Changes to Profiling, Caching, ChiaFunction source code, etc)
• New Chia Tool/Docker Container
• Build system change
• Other — Codex model backend

Contributor Checklist:

• Did you set main as the base branch?
• Is this PR's title suitable for inclusion in the changelog and have you added a changelog:<topic> label?
• Did you state the type-of-change/impact?
• Did you delete any extraneous prints/debugging code?
• Did you mark the PR with a changelog: label?
• (If applicable) Did you add documentation for the feature?
• (If applicable) Did you add a test demonstrating the PR?

AI assistance disclosure:
AI assistance was used during implementation and review. The contributor accepts responsibility for the complete change.

[urd00m]

Don't merge/review yet, will ping when ready.

[urd00m]

can merge now, it works in my testing