fix: make Codex MCP credential inheritance explicit

[kbentonferguson]

Summary

• add explicit Codex MCP env configuration via --env, --inherit-env, --env-file, --map-env, and --force-env
• preserve existing Codex MCP env entries unless --force-env is passed
• keep secret-like values out of installer output, logs, and Codex config by using native --env only when safe and a managed private wrapper/env file otherwise
• make Codex billing detection read $CODEX_HOME/auth.json before falling back to ~/.codex/auth.json
• surface credential env visibility and billing-source evidence in doctor output without printing values

Why

Puppetmaster Codex MCP installs currently depend on whatever environment the MCP host happens to launch with. On Codex, that can silently select the wrong auth context: a user may have an API-key Codex home available, but the MCP server falls back to default codex and ~/.codex/auth.json, hitting ChatGPT/Codex plan usage limits instead of the intended billing path.

This makes credential inheritance explicit, auditable, and provider-shaped. Puppetmaster does not inherit the full parent environment and does not decide a global billing method; users opt specific provider variables into the MCP server environment, including mapping local names into provider-canonical names like CODEX_HOME.

Tests

• python3 -m py_compile puppetmaster/installers.py puppetmaster/cli.py puppetmaster/diagnostics.py puppetmaster/platform_billing.py puppetmaster/mcp_server.py puppetmaster/redaction.py tests/test_puppetmaster.py
• python3 -m pytest tests/test_puppetmaster.py -q -k 'install_codex or uninstall_codex or resolve_mcp_env or codex_billing or doctor or adapter_status or billing or mcp_server'
• python3 -m pytest tests/test_puppetmaster.py -q
• python3 -m puppetmaster install-codex-mcp --dry-run --env-file ~/.config/puppetmaster/env.zsh
• python3 -m puppetmaster install-codex-mcp --help
• CODEX_HOME=<api-key-codex-home> python3 -m puppetmaster doctor --json
• `git diff --check