Codex-driver chats leak into other Codex apps (shared CODEX_HOME) #720

Problem

Chats run on the Codex driver show up in the user's other Codex-based apps. In those apps they're titled with the raw prompt (starting with the injected <context source="Memory …"> block).

Cause

Muster starts codex app-server with CODEX_HOME=~/.codex, which is the same home the user's other Codex clients use. Every Muster turn writes its thread to ~/.codex/sessions/... and ~/.codex/state_5.sqlite with source = "vscode", so other clients list it as one of their own. Seen on 0.3.15: the running app-server has CODEX_HOME=/Users/<user>/.codex, and 48 of 93 Muster chats have a Codex thread there.

Expected

• Muster keeps its own Codex home under ~/Library/Application Support/Muster Agent/ (auth and config carried over, threads written only there).
• The Muster chat ID is the primary identity; the provider thread ID is an internal link only.
• Threads written by the old behaviour are migrated or hidden, with the user's consent; other apps' data is never deleted silently.

Acceptance

• A new Codex-driver chat writes no rollout and no threads row under ~/.codex.
• Existing chats still resume after the move.