[Dkm0315]

Fixes #720

Problem: Muster ran the coding client with the person's own CODEX_HOME, so every Muster chat appeared as a thread in their other coding apps, and those apps' indexes grew with Muster's work.

Fix: Muster now gives the client its own home at <dataDir>/codex-home/<hash of the person's home>:

• codex-home.ts, prepareMusterCodexHome: before each launch, links the shared entries of the person's home into Muster's: auth.json, config.toml, *.config.toml profiles, model catalogs, skills, plugins, rules, prompts, AGENTS files and helpers. Sign-in, profiles and plugins stay shared and up to date. If the client replaced a link with a file, the newer copy goes back to the person's home and the link is restored. Where links can't be made, directories use junctions and files are copied.
• adoptCodexThread: a chat started before this change has its rollout copied into Muster's home once. It then continues its own thread with its full history, and the person's copy is never written to again.
• provider-instances.ts: routes get CODEX_HOME=<own home> and MUSTER_CODEX_SOURCE_HOME=<person's home>, and sessionsRoot points at the own home.
  • Exception: a ChatGPT sign-in kept only in the Keychain is tied to the home path, so that route keeps the person's home.
  • MUSTER_SHARED_CODEX_HOME=1 restores the old behaviour.
• provider-usage.ts: usage reads the own home and the linked person's home and takes the newest rate-limit reading, so limits recorded by other apps still show.

Muster never deletes or hides threads in other apps.

Tests: tests/own-codex-home-720.test.ts (MUS-SPEC-03-720A/B/C). These are real-client e2e runs against a local mock router.

• 720A: a new chat writes no rollout or thread index to the person's home, the profile is untouched, and follow-ups keep the thread.
• 720B: a chat from the shared home keeps its thread and history, and the old file doesn't grow.
• 720C: a newer reading in the person's home is shown.
• Red on main for 720A/B and red without the usage change for 720C. Logs: review/720/RED-720.log, RED-720C.log, GREEN-720.log.
• provider-discovery, provider-instances-cache, router-usage-workflow, provider-binding, claude-messages-lane, replay-expired-716 and image-inputs pass, and typecheck is clean.
• provider-auth-e2e (b) fails locally on main too, because it reads the machine's own gateway profile. That failure is unrelated to this change.