[FEATURE] CODEX_HOME should support shared auth with isolated config/skills

Problem

When using CODEX_HOME to isolate config and skills for programmatic eval/CI use cases, authentication breaks because auth.json cannot be reliably copied or symlinked between the real ~/.codex/ and the custom CODEX_HOME.

The root cause: OAuth refresh tokens in auth.json are single-use. When the real Codex instance refreshes the token, any copy becomes invalid. This makes CODEX_HOME unusable for config isolation while maintaining ChatGPT subscription auth.

Use case

Running eval experiments where each agent run needs:

• Isolated config: no personal MCP servers, hooks, or settings
• Custom skills: only specific skills installed (to A/B test skill effectiveness)
• Shared auth: still uses the user's ChatGPT subscription (no separate API key billing)
• Non-interactive: codex exec in automation

Current behavior

1. Set CODEX_HOME=/tmp/eval_home with minimal config.toml and custom skills/
2. Copy auth.json from ~/.codex/auth.json
3. First run may work (uses cached access token)
4. Subsequent runs fail with 401 if the real Codex refreshed the token, invalidating the copy

Proposed solution

Either:

• Auth fallback: when CODEX_HOME is set and auth.json is missing or invalid, fall back to ~/.codex/auth.json for authentication only (not config/skills)
• Auth symlink support: detect and follow symlinks for auth.json so both paths read the same file
• Separate auth path: CODEX_AUTH_HOME or --auth-from flag to specify where auth is read from, independent of CODEX_HOME

Related issues

• #14330 (environment isolation — wants fully separate auth per env)
• #3820 (headless auth for ChatGPT plans)
• #6036 (refresh token single-use invalidation)