fix: fail closed on unusable Codex auth during sandbox auth merge

When reusing a Codex sandbox, the workspace-restore step now performs
an auth-merge check before adopting the sandbox's auth.json. The merge
fails closed when:

- host or sandbox Codex auth is unusable (missing token or account)
- the subscription payload shapes differ between host and sandbox
- subscription account identities do not match

Additional hardening: node absence on PATH during the embedded decision
script now exits non-zero instead of silently falling through. Co-change
comments link parseAuth (the embedded script) to hasUsableAuthPayload
(codex-home.ts) so a future auth-format change cannot silently diverge
between the two implementations.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

docs/cli/overview.md

@@ -0,0 +1,77 @@
+---
+title: CLI Overview
+summary: CLI installation and setup
+---
+
+The Paperclip CLI handles instance setup, diagnostics, and control-plane operations.
+
+## Usage
+
+```sh
+pnpm paperclipai --help
+```
+
+## Global Options
+
+All commands support:
+
+| Flag | Description |
+|------|-------------|
+| `--data-dir <path>` | Local Paperclip data root (isolates from `~/.paperclip`) |
+| `--api-base <url>` | API base URL |
+| `--api-key <token>` | API authentication token |
+| `--context <path>` | Context file path |
+| `--profile <name>` | Context profile name |
+| `--json` | Output as JSON |
+
+Company-scoped commands also accept `--company-id <id>`.
+
+For clean local instances, pass `--data-dir` on the command you run:
+
+```sh
+pnpm paperclipai run --data-dir ./tmp/paperclip-dev
+```
+
+## Context Profiles
+
+Store defaults to avoid repeating flags:
+
+```sh
+# Set defaults
+pnpm paperclipai context set --api-base http://localhost:3100 --company-id <id>
+
+# View current context
+pnpm paperclipai context show
+
+# List profiles
+pnpm paperclipai context list
+
+# Switch profile
+pnpm paperclipai context use default
+```
+
+To avoid storing secrets in context, use an env var:
+
+```sh
+pnpm paperclipai context set --api-key-env-var-name PAPERCLIP_API_KEY
+export PAPERCLIP_API_KEY=...
+```
+
+Secret operations are available under `paperclipai secrets`:
+
+```sh
+pnpm paperclipai secrets declarations --company-id <company-id> --kind secret
+pnpm paperclipai secrets create --company-id <company-id> --name anthropic-api-key --value-env ANTHROPIC_API_KEY
+pnpm paperclipai secrets link --company-id <company-id> --name prod-stripe-key --provider aws_secrets_manager --external-ref <provider-ref>
+pnpm paperclipai secrets doctor --company-id <company-id>
+pnpm paperclipai secrets migrate-inline-env --company-id <company-id> --apply
+```
+
+Context is stored at `~/.paperclip/context.json`.
+
+## Command Categories
+
+The CLI has two categories:
+
+1. **[Setup commands](/cli/setup-commands)** — instance bootstrap, diagnostics, configuration
+2. **[Control-plane commands](/cli/control-plane-commands)** — issues, agents, approvals, activity