feat(coding): add public managed Codex workflow

[levineam]

Summary

jarvOS-coding now provides a public, owner-bound Codex workflow instead of relying on implicit skill selection. The deterministic path creates one durable run, fences plan acceptance, preserves safe provider-to-native fallback, and finishes only after authoritative verification.

A verified managed run can now record one reusable learning automatically. The learning tail is durable and idempotent, so a skipped, failed, or retried capture never changes the completed coding result.

Design decisions

• The public MCP exposes only plan, accept-plan, work, finish, status, and resume, plus repository and health discovery.
• Repository roots, worktrees, credentials, and provider choices stay in an owner-provisioned registry. They are not accepted from model-facing requests.
• Natural routing remains explicitly unavailable. Direct managed invocation is the supported path until live Codex-routing conformance exists.

Validation

• node --test modules/jarvos-coding/test/*.test.js (149 passing)
• Runtime, packaging, Hermes artifact, and release-readiness checks (51 passing)
• node scripts/release-readiness-check.js --allow-dirty --allow-unreleased --allow-existing-tag --skip-smoke (READY v0.7.0)