### What happened

The `omarchy.agents` panel shows **CODEX LIMITS UNAVAILABLE** for the Codex tab, with a red auth-help card reading just `initialize`. Token stats still render; only limits/plan are missing.

### Cause

`bin/omarchy-agent-usage-codex` spawns the app-server with an approval policy that recent Codex CLI releases no longer accept:

```python
# bin/omarchy-agent-usage-codex:531
[codex, "-s", "read-only", "-a", "untrusted", "app-server"],
```

codex-cli 0.151.0:

```
$ codex -s read-only -a untrusted app-server
error: invalid value 'untrusted' for '--ask-for-approval <APPROVAL_POLICY>'
  [possible values: on-request, never]
```

The process exits immediately, so `rpc_request()` reads EOF from stdout and raises `TimeoutError("initialize")`. `fetch_codex_rpc()` catches it and stores `str(exc)` in `authHelpText` — which is why the panel renders the bare word `initialize` as auth help. That also explains the misleading message: this is not an auth problem at all, the user is signed in.

### Steps to reproduce

1. Install codex-cli >= 0.151.0 and sign in (`codex login`).
2. `omarchy-agent-usage-update codex`
3. `jq '{tierLabel, usageStatusText, authHelpText, limits}' ~/.local/state/omarchy/agents/usage/codex.json`

```json
{
  "tierLabel": "",
  "usageStatusText": "Codex limits unavailable",
  "authHelpText": "initialize",
  "limits": []
}
```

### Expected

Plan label and rate-limit meters, as the collector produced with older codex-cli.

### Fix

Changing `"untrusted"` to `"never"` on line 531 resolves it. Same command, verified locally:

```json
{
  "tierLabel": "pro",
  "usageStatusText": "",
  "authHelpText": "Run `codex login` to authenticate.",
  "limits": [{"label": "Weekly (7-day)", "percent": 0.08, "resetsAt": "2026-09-03T16:35:55+00:00"}]
}
```

`never` is the only remaining value with the old semantics of "do not prompt"; the collector never starts a turn, so approval policy is inert here anyway. Dropping `-a` entirely would work too and would be immune to the next enum change.

Secondary suggestion: `rpc_request()` raising `TimeoutError(method)` means the method name leaks into the panel as user-facing auth help. A message like `f"Codex app-server did not answer {method}"` — or detecting immediate process exit separately from a real timeout — would make this class of failure self-explanatory.

### System

- Omarchy 4.0.1-1
- codex-cli 0.151.0
- Hyprland / Arch, x86_64