feat: enhance Codex options for CLI bootstrap and checksum verification

[activadee]

Introduce new options for Codex CLI configuration, allowing users to specify cache directory, release tag, and checksum for integrity verification. Update related code to support these features and improve the overall bootstrapping process.

closes #15

[github-actions]

Codex Review Summary

Recommendation: ✅ Ready to merge – no blocking issues detected.

Summary:
No blocking issues found. The new CLI bootstrap knobs are properly plumbed through codexexec.New (codex.go:14, internal/codexexec/runner.go:21-74) and the discovery logic now refuses to fall back to $PATH when a release or checksum was requested (internal/codexexec/runner.go:253), so integrity guarantees hold. bundleConfig centralizes cache/release/checksum handling and verifies both cached and freshly downloaded binaries, and the expanded unit tests cover cache precedence, release overrides, checksum success/failure, and fallback behavior (internal/codexexec/bundle_test.go:1-260), which gives good confidence in the new paths. Documentation clearly describes the new options (README.md:11-52, options.go:32-44). Residual risk is limited to the expected case where checksum enforcement is bypassed if a caller supplies CodexPathOverride; otherwise the implementation looks sound.

Inline findings:

• No inline findings.

Generated at 2025-11-09T20:30:18.221Z.