## What happened

The agents panel shows no Codex limits. Instead the Codex tab renders "Codex limits unavailable" with a red help box containing the single word `initialize`.

The written record confirms it:

```json
{"id":"codex","ready":true,"hasLocalStats":true,
 "limits":[],"tierLabel":"",
 "usageStatusText":"Codex limits unavailable",
 "authHelpText":"initialize"}
```

Local stats collect fine, so only the RPC limits probe is broken. Claude's tab works normally on the same machine.

## Root cause

`bin/omarchy-agent-usage-codex:531` launches the app-server with an approval policy that current codex-cli no longer accepts:

```python
[codex, "-s", "read-only", "-a", "untrusted", "app-server"],
```

codex-cli 0.149.0 dropped `untrusted` from `--ask-for-approval`:

```
$ codex --help
  -a, --ask-for-approval <APPROVAL_POLICY>
          Possible values:
          - on-request: The model decides when to ask the user for approval
          - never:      Never ask for user approval

$ codex -s read-only -a untrusted app-server
error: invalid value 'untrusted' for '--ask-for-approval <APPROVAL_POLICY>'
  [possible values: on-request, never]
```

The process exits immediately. Two things then hide the real error:

1. `stderr=subprocess.DEVNULL` in the `Popen` call discards the message.
2. `Popen` itself still succeeds, so the `except` around it never fires.

Control reaches `rpc_request`, which waits 8s and hits `raise TimeoutError(method)` (line 495). `str(exc)` is therefore just the method name, which is why `authHelpText` reads `initialize` rather than anything actionable.

## Steps to reproduce

1. Install codex-cli 0.149.0 and sign in.
2. Run `omarchy agent usage-update --force codex`.
3. Inspect `~/.local/state/omarchy/agents/usage/codex.json` - `limits` is empty and `authHelpText` is `initialize`.

## Expected

Codex rate limits appear in the agents panel.

## Suggested fix

Change `untrusted` to `never` on line 531. Verified working on this machine - the full RPC sequence then succeeds:

```
init:    {"id":1,"result":{"userAgent":"omarchy-agent-usage/0.149.0 ...","codexHome":"/home/<user>/.codex"}}
account: {"id":2,"result":{"account":{"type":"chatgpt","planType":"plus"},"requiresOpenaiAuth":true}}
limits:  {"id":3,"result":{"rateLimits":{"limitId":"codex","primary":{"usedPercent":3,"windowDurationMins":10080,"resetsAt":1788140941},"planType":"plus"}}}
```

`never` is the right choice over `on-request` here: the collector is non-interactive, sandboxed `read-only`, and only issues `account/read` and `account/rateLimits/read`, so there is nothing to approve.

Two hardening suggestions while in this code path, both optional:

- Capture stderr instead of discarding it, and surface it in `authHelpText` when the process has already exited. A flag rejection currently costs an 8s timeout and produces a misleading message.
- Give `TimeoutError` a message with context, e.g. `TimeoutError(f"{method} timed out after {timeout}s")`, so a genuine timeout does not surface in the UI as a bare method name.

## System

- Omarchy 4.0.0-1
- codex-cli 0.149.0 (mise-managed)
- Kernel 7.1.8-arch1-3
- Intel i7-9750H / UHD Graphics 630 + NVIDIA GTX 1650 Mobile