fix(auth): migrate linked Codex aliases safely

[cooper-oai]

Summary

Part 4 of 8. Depends on part 3.

• keep shared-row round-robin ordering profile-local
• migrate refresh-linked legacy aliases safely
• route linked aliases through canonical refresh and persistence
• classify linked aliases by refresh family even when cached access tokens differ

Why

Older Hermes versions could leave profile-local aliases for the canonical Codex token family. Those aliases must rotate with the canonical credential instead of independently spending a stale refresh token.

This is a fork-local stacked draft. Promote it upstream after part 3 lands.

Validation

• focused suite at this layer: 424 passed, 2 skipped
• ruff, py_compile, Windows footgun scan, and git diff --check: clean

Stack

Priority order, highest to lowest:

1. NousResearch/hermes-agent#34820 — prevent Hermes Codex OAuth refresh-token reuse
2. cooper-oai/hermes-agent#1 — share canonical Codex state across profiles
3. cooper-oai/hermes-agent#2 — reconcile stale Codex pool snapshots
4. cooper-oai/hermes-agent#3 — migrate linked Codex aliases safely
5. cooper-oai/hermes-agent#4 — guard shared Codex store consumers
6. cooper-oai/hermes-agent#5 — quarantine Codex families by composite identity
7. cooper-oai/hermes-agent#6 — harden Codex migration and fallback routing
8. cooper-oai/hermes-agent#7 — avoid Codex refresh contention and fix guidance

Part 1 targets upstream main. Parts 2-8 are fork-local dependent drafts so each diff stays reviewable; promote each part upstream after the part below it lands.