Feature request: add codex config check for deterministic effective-config validation

What variant of Codex are you using?

CLI (Codex 0.145.0; this would also benefit CI and managed multi-machine setups).

What feature would you like to see?

Add a deterministic configuration-only command, for example:

codex config check
codex config check --json

The command should validate the effective Codex configuration using the same resolver and schema as runtime startup, without starting a model session, contacting a provider, modifying configuration, or probing external services.

Suggested behavior:

1. Parse all active layers and report TOML syntax errors with file and line information.
2. Resolve the effective configuration using the normal precedence rules (system, user, selected profile, and trusted project layers).
3. Reject unknown keys and invalid values using the same runtime schema.
4. Report deprecated keys and project-scoped keys that Codex ignores for security reasons.
5. Optionally show a redacted provenance summary of effective values and the layer that supplied each value.
6. Provide stable human output and --json output, with exit status 0 for valid configuration and nonzero for validation failures.
7. Never print secret values or write/migrate configuration.

This is analogous to a configuration check command such as sing-box check -c config.json: it gives users and CI a fast, deterministic preflight before launching an agent.

Today the closest pieces are not equivalent:

• codex doctor --json is a broad environment diagnostic.
• --strict-config is attached to a runtime command such as codex exec, so using it for validation starts an agent-oriented command rather than a configuration-only check.
• The published JSON Schema is useful for editor diagnostics, but it cannot verify the CLI's effective layered configuration or runtime-specific ignored/deprecated settings.

Additional information

Related issues, but not duplicates:

• #10495 documents the published JSON Schema for editor validation.
• #26593 shows that schema coverage can lag runtime behavior.
• #33181 shows that --strict-config can reject configuration/state produced by another current Codex surface.

A small, non-networked, no-model CLI command would make configuration validation easier to automate and would provide a stable contract for deployment and dotfile workflows.