feat(codex-local): add Codex auth precedence resolver

Adds auth-precedence.ts — a pure module that resolves which Codex credential
wins when multiple credential sources are present (configured API key, host
auth.json, sandbox auth.json). Exposes a shouldWarn flag for when a sandbox
snapshot login is shadowed by host credentials, enabling callers to emit a
visible run-log warning instead of silently overriding the sandbox session.

Precedence order: configured_api_key > host_auth_json > sandbox_auth_json > none

Co-Authored-By: Paperclip <noreply@paperclip.ing>

packages/adapters/codex-local/src/server/auth-precedence.ts

@@ -0,0 +1,46 @@
+export const CODEX_SANDBOX_AUTH_PRECEDENCE_WARNING =
+  "snapshot login present but host credentials take precedence";
+export const CODEX_SANDBOX_AUTH_PRECEDENCE_WARNING_LOG_LINE =
+  `[paperclip] Warning: ${CODEX_SANDBOX_AUTH_PRECEDENCE_WARNING}.\n`;
+export const CODEX_SANDBOX_AUTH_EXISTS_COMMAND =
+  'test -f "$HOME/.codex/auth.json"';
+
+export type CodexAuthPrecedenceWinner =
+  | "configured_api_key"
+  | "host_auth_json"
+  | "sandbox_auth_json"
+  | "none";
+
+export interface CodexAuthPrecedenceInput {
+  configuredApiKey: boolean;
+  hostAuthJson: boolean;
+  sandboxAuthJson: boolean;
+}
+
+export interface CodexAuthPrecedenceResolution {
+  winner: CodexAuthPrecedenceWinner;
+  sandboxLoginShadowed: boolean;
+  shouldWarn: boolean;
+}
+
+export function resolveCodexAuthPrecedence(
+  input: CodexAuthPrecedenceInput,
+): CodexAuthPrecedenceResolution {
+  const winner: CodexAuthPrecedenceWinner =
+    input.configuredApiKey
+      ? "configured_api_key"
+      : input.hostAuthJson
+        ? "host_auth_json"
+        : input.sandboxAuthJson
+          ? "sandbox_auth_json"
+          : "none";
+  const sandboxLoginShadowed =
+    input.sandboxAuthJson &&
+    (winner === "configured_api_key" || winner === "host_auth_json");
+
+  return {
+    winner,
+    sandboxLoginShadowed,
+    shouldWarn: sandboxLoginShadowed,
+  };
+}