Deleting CODEX_HOME / OPENAI_API_KEY from a codex_local agent config no
longer silently re-injects them. The previous isolation guard force-set a
per-agent CODEX_HOME and OPENAI_API_KEY="" on every codex_local agent and
rejected shared homes, which broke the common case where every agent on a
device should share the host's Codex login (~/.codex or $CODEX_HOME).
A keyless agent now gets no env overrides and falls back to the host
credentials at runtime. We only carve out an isolated per-agent CODEX_HOME
when the agent sets its own OPENAI_API_KEY, so that api-key auth.json does
not collide with the shared company home other agents use for the host
login. This supports the edge case of pointing two agents at different
accounts via a per-agent key.