test(adapters): live codex install gate — real-cli verification that skips when codex is absent

[plind-junior]

tests/test_openclaw_plugin_load_real.py set the pattern: a live gate that exercises the real host cli when it's on PATH and skips (not fails) where it isn't, e.g. github ci. the codex adapter has no equivalent, so regressions in the shipped config only surface when a user hits them — the current T1 silent-skip behavior (installer no-op when .codex/config.toml exists) is exactly the class of bug a live gate would have caught.

proposed change

• tests/test_codex_adapter_load_real.py: with codex on PATH, in a temp project run vouch install-mcp codex at the highest shipped tier, then assert through codex itself — codex mcp list (or the current cli equivalent) shows the vouch server, and the resulting config parses as valid toml with [mcp_servers.vouch] sitting next to a pre-seeded unrelated entry.
• assert on the observable contract (server listed, config valid, agents snippet present), not codex internals, so codex version bumps don't break the suite.
• isolate fully: point codex at a temp home (CODEX_HOME or equivalent), never mutate the real ~/.codex, no network, no credentials.
• skip cleanly when the cli is missing.

acceptance criteria

• test passes locally with codex installed; skips on machines without it
• covers both merge-into-existing-config and fresh-install paths at the live level
• no network access and no writes outside the temp project/home
• runs in the normal pytest invocation (no separate ci job required)