codex update uses standalone install.sh path instead of detecting npm-managed install

Environment

• OS: Ubuntu 22.04.5 LTS
• Codex before update: codex-cli 0.132.0
• Codex after npm reinstall: codex-cli 0.133.0
• npm package: @openai/codex@0.133.0

Related issue: #24034

Observed behavior

Running:

codex update

attempted to update Codex via:

sh -c 'curl -fsSL https://chatgpt.com/codex/install.sh | sh'

The update then failed with:

Could not find SHA-256 digest for codex-package-x86_64-unknown-linux-musl.tar.gz in codex-package_SHA256SUMS.
Error: `sh -c 'curl -fsSL https://chatgpt.com/codex/install.sh | sh'` failed with status exit status: 1

Before reinstalling with npm, the active Codex command resolved to:

/root/.codex/packages/standalone/releases/0.132.0-x86_64-unknown-linux-musl/codex

After running:

npm install -g @openai/codex@0.133.0

the same command resolved to:

/root/.local/lib/node_modules/@openai/codex/bin/codex.js

and:

codex --version

reported:

codex-cli 0.133.0

Expected behavior

If the active Codex installation is npm-managed, Codex should either:

1. use npm-compatible update guidance, for example:

``bash
npm i -g @openai/codex@latest
``

1. refuse self-update with a clear message explaining that this install should be updated through npm
2. clearly state that the currently executing binary is standalone-managed, if that is the case

Actual problem

The update path was confusing because /root/.local/bin/codex stayed the visible command path, but the resolved target changed from a standalone binary to the npm package after reinstall. From the user perspective, Codex appeared npm-installed/managed, but codex update used the standalone install.sh path.

Why this matters

This creates a misleading mixed-install state and makes it unclear whether the user should use:

• codex update
• npm install -g @openai/codex@latest
• install.sh / standalone updater

It also relates to #24034, where codex remote-control start used a stale standalone app-server even after the shell CLI had been upgraded via npm.

Suggested fix

Improve install-method detection and messaging:

• detect npm-managed installs and recommend npm update
• detect standalone installs and say explicitly that the standalone updater is being used
• avoid silently using install.sh when the visible command path is a wrapper/symlink under ~/.local/bin
• include resolved executable path and install method in the update output