Split config and session state directories via env var to enable RO Docker mount of ~/.codex

What feature would you like to see?

Currently, CODEX_HOME stores both configs and session state.

What we want is to mount CODEX_HOME read-only in our docker dev env, and tell codex to write state to SESSION_HOME set to /tmp.

Instead, the most obvious answer is to copy files into the container on build, which is both bad practice and less flexible.

Additional information

_No response_