## What happened

The Agents bar widget's Codex rate-limit lookup always fails with `usageStatusText: "Codex limits unavailable"`, even with a freshly-authenticated `codex` CLI.

Running the collector directly reproduces it:

```
$ omarchy-agent-usage-codex --force
{"schemaVersion":1,"id":"codex", ... ,"limits":[],"tierLabel":"","usageStatusText":"Codex limits unavailable","authHelpText":"initialize"}
```

## Root cause

`omarchy-agent-usage-codex` spawns the RPC subprocess with a hardcoded approval-policy flag:

```python
[codex, "-s", "read-only", "-a", "untrusted", "app-server"]
```

Running that exact command manually shows the actual failure — it's a CLI argument-parsing error, not an auth/RPC problem:

```
$ codex -s read-only -a untrusted app-server
error: invalid value 'untrusted' for '--ask-for-approval <APPROVAL_POLICY>'
  [possible values: on-request, never]

For more information, try '--help'.
```

The installed `codex-cli` (0.151.0) no longer accepts `untrusted` as a value for `-a`/`--ask-for-approval` — only `on-request` and `never` are valid now. The subprocess exits (code 2) before the JSON-RPC `initialize` handshake is ever sent, which is why the collector's error hint says `"authHelpText":"initialize"` even though authentication is fine (verified: `~/.codex/auth.json` has a `last_refresh` from minutes before reproducing this).

## Expected

The Codex tab in the Agents panel shows real rate-limit data for an authenticated `codex` CLI.

## Actual

Codex never shows usable limits — `"limits":[]` and `"usageStatusText":"Codex limits unavailable"` — because the RPC subprocess fails to start.

## Steps to reproduce

1. Have `codex-cli` 0.151.0 (or any version where `-a untrusted` is invalid) on `PATH` and authenticated (`codex login`).
2. Run `omarchy-agent-usage-codex --force`.
3. Observe `"limits":[]` and `"usageStatusText":"Codex limits unavailable"` in the output, despite valid auth.
4. Confirm directly: `codex -s read-only -a untrusted app-server` → `error: invalid value 'untrusted' for '--ask-for-approval <APPROVAL_POLICY>'`.

## System details

- Omarchy version: `4.0.1-1`
- `codex --version`: `codex-cli 0.151.0`
- Relevant file: `/usr/share/omarchy/bin/omarchy-agent-usage-codex` (the `fetch_codex_rpc()` function, `[codex, "-s", "read-only", "-a", "untrusted", "app-server"]`)

## Suggested fix

Update the hardcoded value to one of the currently-valid options (`never` looks like the closest intent to a previous "untrusted" policy for a read-only, non-interactive usage probe), or detect the CLI's supported values before choosing one.