## What happened

The "Agents" bar widget's Codex tab always shows "Codex limits unavailable"
with a red status box whose text just reads "initialize" — even with Codex
CLI installed, authenticated, and working normally for actual coding.

## Root cause (traced in source)

`/usr/bin/omarchy-agent-usage-codex` (the widget's collector script) launches
the Codex app-server RPC with a hardcoded approval-policy flag:

```
codex -s read-only -a untrusted app-server
```

Current Codex CLI (0.149.0) only accepts `-a on-request` or `-a never` —
`untrusted` is not a valid value for `-a`/`--ask-for-approval` and Codex
exits immediately with a CLI parse error:

```
$ codex -s read-only -a untrusted app-server
error: invalid value 'untrusted' for '--ask-for-approval <APPROVAL_POLICY>'
  [possible values: on-request, never]
```

Because the subprocess exits before ever responding, the widget's
`initialize` RPC call times out (8s), lands in the `except` branch in
`fetch_codex_rpc()`, and sets:

```python
result["usageStatusText"] = "Codex limits unavailable"
result["authHelpText"] = str(exc)   # == "initialize" (the TimeoutError's method name)
```

`authHelpText` is what the panel renders in the red status box — so the box
shows the literal string "initialize" rather than anything describing the
actual problem, which made it look like a broken/grayed-out button in the UI
rather than an error message.

## Impact

Cosmetic only — the widget's usage/limits display for Codex never populates.
Codex CLI itself works fine for actual coding sessions; this only affects
the bar-panel usage probe.

## Expected behavior

The collector's `-a` value should match a Codex CLI approval-policy value
that still exists (e.g. `never`, since the RPC probe doesn't need to ask for
approval on anything). Suggest updating the hardcoded invocation in
`fetch_codex_rpc()` (`/usr/bin/omarchy-agent-usage-codex` /
`/usr/share/omarchy/bin/omarchy-agent-usage-codex`) from `-a untrusted` to
`-a never`, and/or wrapping the subprocess launch failure with a clearer
message than the raw RPC method name so future CLI flag drift is easier to
diagnose from the UI alone.

## Steps to reproduce

1. Have Codex CLI installed and authenticated (`codex login`).
2. Open the Agents bar widget, select the Codex tab.
3. Observe "Codex limits unavailable" with status text "initialize".
4. Confirm directly: `codex -s read-only -a untrusted app-server` errors with
   an invalid-value message for `-a`.

## System details

- Omarchy version: 4.0.0-1
- CPU: AMD Ryzen 7 7800X3D
- GPU: NVIDIA GeForce RTX 5070 Ti (discrete) + AMD Raphael (Ryzen integrated)
- Codex CLI version: codex-cli 0.149.0
- `omarchy debug` is not available in this Omarchy version (`Unknown Omarchy
  command`), so this report uses manually gathered equivalents instead of
  the standard diagnostic log.