fix(models): discover current Codex subscription models

[drewstone]

Problem

CLI Bridge main statically advertises only:

• codex/default
• codex/gpt-5-codex
• codex/gpt-5.4
• codex/gpt-5.5

Codex CLI 0.147.0 successfully executed gpt-5.6-luna through the active ChatGPT subscription on 2026-08-10, but /v1/models did not advertise codex/gpt-5.6-luna. CodexBackend.matches() accepts the route, so discovery and execution disagree.

Impact

Braid and other exact-profile clients use /v1/models before dispatch. They cannot select a runnable current Codex model without bypassing capability validation. A static model list also drifts every time Codex adds or removes a model.

Completion criteria

• Derive Codex model availability from the installed CLI/subscription when the CLI exposes it, or maintain one versioned capability source with an explicit freshness check.
• Advertise codex/default and every model the current subscription can actually select.
• Do not advertise a model when entitlement validation fails.
• Keep arbitrary direct model IDs fail-honest if the CLI rejects them.
• Cover Codex CLI 0.147.0 and gpt-5.6-luna in discovery and request-routing tests.
• Make /health//v1/models consistent with a real startup probe once fix(codex): keep CODEX_HOME writable under fs-jail #130 is fixed.