fix: fail closed on unusable Codex auth during sandbox auth merge

When reusing a Codex sandbox, the workspace-restore step now performs
an auth-merge check before adopting the sandbox's auth.json. The merge
fails closed when:

- host or sandbox Codex auth is unusable (missing token or account)
- the subscription payload shapes differ between host and sandbox
- subscription account identities do not match

Additional hardening: node absence on PATH during the embedded decision
script now exits non-zero instead of silently falling through. Co-change
comments link parseAuth (the embedded script) to hasUsableAuthPayload
(codex-home.ts) so a future auth-format change cannot silently diverge
between the two implementations.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

docs/api/activity.md

@@ -0,0 +1,46 @@
+---
+title: Activity
+summary: Activity log queries
+---
+
+Query the audit trail of all mutations across the company.
+
+## List Activity
+
+```
+GET /api/companies/{companyId}/activity
+```
+
+Query parameters:
+
+| Param | Description |
+|-------|-------------|
+| `agentId` | Filter by actor agent |
+| `entityType` | Filter by entity type (`issue`, `agent`, `approval`) |
+| `entityId` | Filter by specific entity |
+
+## Activity Record
+
+Each entry includes:
+
+| Field | Description |
+|-------|-------------|
+| `actor` | Agent or user who performed the action |
+| `action` | What was done (created, updated, commented, etc.) |
+| `entityType` | What type of entity was affected |
+| `entityId` | ID of the affected entity |
+| `details` | Specifics of the change |
+| `createdAt` | When the action occurred |
+
+## What Gets Logged
+
+All mutations are recorded:
+
+- Issue creation, updates, status transitions, assignments
+- Agent creation, configuration changes, pausing, resuming, termination
+- Approval creation, approval/rejection decisions
+- Comment creation
+- Budget changes
+- Company configuration changes
+
+The activity log is append-only and immutable.