chore(deps): pin Codex provider to published npm 0.1.1

[TheGreatAxios]

Summary

• Pins @corbits/codex-provider to published npm 0.1.1 instead of the GitHub HEAD specifier.
• Host Codex adapter and auth imports keep the same public exports; sibling github: specs for oauth-core, openai-responses, and xai-provider stay unchanged.
• Pins accountIdFromIdToken to drop CR/LF/NUL account ids so they cannot split chatgpt-account-id.

The published package ships compiled dist and declares peers @corbits/oauth-core ^0.2.0, @corbits/openai-responses ^0.2.0, and @intx/{inference,types} ^0.4.0. The host still resolves those peers from the existing GitHub pins and vendored Interchange 0.3.0. refreshCodexTokens accepts optional previous tokens. The host still supplies CodexQuirks and still rewrites parallel_tool_calls to true on the wire.

Verification

• bun run check exits 0 (lint, typecheck, dead-exports, build, guarded test suite: 8591 pass, 0 fail)

Fixes CL-9464

[linear-code]

CL-9464