feat: the Codex exception register #345

Why

Some Codex settings exist only in ~/.codex/config.toml (design Decision 6).

In scope

CODEX_USER_EXCEPTIONS constant: consented trust_level, tui.status_line, model_context_window and ak-caused repairs (including the claude-flow placeholder); reference-counted from project state; ak x statusline and ak x codex-context become init choices.

Out of scope

Any other user key.

Acceptance criteria

• Only register keys change in ~/.codex/config.toml
• The last project to release a key removes it
• trusted_hash is never written

Dependencies

Blocked by: #344

Blocks: #346, #355, #373, #385

Plan

• Release: 4.0.0-beta.1
• Size: size:M · Workstream: ws:project-scope
• Epic: feat: project-scope P3, Codex and OpenCode project settings (epic) #298
• Card: P3-02 in the card inventory
• Sources: Design (docs(plans): project-scoped management design and its prerequisites #289) Codex exception register

Verification

• Contract test from test: contract tests with the current violations as baseline #328