[BUG] global audit scans unmanaged Codex session history for hidden Unicode #3036

Describe the bug

APM 0.31.0's global audit scans Codex session history under ~/.codex/sessions/ as deployed content. A literal U+202E RIGHT-TO-LEFT OVERRIDE in an unmanaged session file causes apm audit --ci to fail its content-integrity check and recommend apm audit --strip.

This reproduces with an empty global dependency list. APM did not install or record ownership of the session file.

To Reproduce

1. In an isolated test home, create ~/.apm/apm.yml:

   name: global-profile
   version: 1.0.0
   targets: [codex]
   dependencies:
     apm: []
     mcp: []

2. Create ~/.codex/sessions/unmanaged.jsonl with a JSON string containing a literal U+202E character. For example, this Python expression produces the file contents (the character must be literal, not a JSON escape):

   json.dumps({"message": "safe" + chr(0x202E) + "reversed"}, ensure_ascii=False) + "\n"

3. Run apm lock -g, then run apm audit --ci --no-policy --no-drift from ~/.apm in that same test home.

4. Observe exit code 1 and the content-integrity finding below.

Expected behavior

Audit excludes unrelated Codex application state such as session history. Hidden-Unicode scanning should still cover deployable primitive locations, including unrecorded files in those locations, and explicit deployment claims.

Environment (please complete the following information):

• OS: macOS
• Python Version: 3.14.7
• APM Version: 0.31.0 (Homebrew); also reproduced with current main

Logs

content-integrity: 1 file(s) with critical hidden Unicode
-- run 'apm audit --strip' to clean Unicode

content-integrity details:
  - unicode: .codex/sessions/unmanaged.jsonl

[x] 1 of 8 check(s) failed

Additional context

The Codex target declares .codex as its root. install_governance includes the whole root prefix, and the audit scanner recursively scans that prefix. This brings session history into the scan despite it being outside the target's primitive locations.