**Title:** `omarchy-agent-usage-codex` passes a removed `--ask-for-approval` value, so Codex limits never load

## What happens

The Agents bar widget always shows **"Codex limits unavailable"** for Codex, with an empty `limits[]`, even with a fully authenticated `codex` CLI. Claude limits work fine on the same machine.

The written record ends up as:

```json
{
  "id": "codex",
  "ready": true,
  "tierLabel": "",
  "usageStatusText": "Codex limits unavailable",
  "authHelpText": "initialize",
  "limits": []
}
```

## Cause

`bin/omarchy-agent-usage-codex:531` starts the app-server with `-a untrusted`:

```python
proc = subprocess.Popen(
  [codex, "-s", "read-only", "-a", "untrusted", "app-server"],
```

`untrusted` is no longer a valid `--ask-for-approval` value in current Codex CLI (0.153.4):

```
$ codex -s read-only -a untrusted app-server
error: invalid value 'untrusted' for '--ask-for-approval <APPROVAL_POLICY>'
  [possible values: on-request, never]
```

The process therefore exits immediately, `rpc_request` never sees a reply, and its
`raise TimeoutError(method)` surfaces as `authHelpText: "initialize"` — which reads like an
auth or handshake problem rather than a bad CLI argument.

## Fix

`-a never` works. Same sequence against the same CLI, stdin held open between calls:

```
{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"clientInfo":{"name":"probe","version":"1"}}}
{"jsonrpc":"2.0","id":2,"method":"account/read","params":{}}
{"jsonrpc":"2.0","id":3,"method":"account/rateLimits/read","params":{}}
```

returns exactly what the collector wants:

```json
{"id":2,"result":{"account":{"type":"chatgpt","planType":"<plan>"}}}
{"id":3,"result":{"rateLimits":{
  "primary":  {"usedPercent":<n>,"windowDurationMins":300,  "resetsAt":<epoch>},
  "secondary":{"usedPercent":<n>,"windowDurationMins":10080,"resetsAt":<epoch>}}}}
```

(values redacted; `windowDurationMins` 300 / 10080 are the 5-hour and weekly windows
the collector maps to its two limit rows.)

So the one-line change is `"untrusted"` → `"never"` on line 531.

## Secondary suggestion

`stderr=subprocess.DEVNULL` on that `Popen` is what made this hard to diagnose — the CLI
printed a precise error and it was discarded, leaving only a timeout on `initialize`.
Capturing stderr and putting it in `authHelpText` when the handshake fails would have
made this self-evident. Worth considering independently of the fix above, since it will
happen again the next time the Codex CLI changes an argument.

## Steps to reproduce

1. Authenticate the Codex CLI (`codex login`) on a ChatGPT plan.
2. Run `omarchy-agent-usage-codex --force`.
3. Inspect `~/.local/state/omarchy/agents/usage/codex.json` — `limits` is `[]` and
   `authHelpText` is `"initialize"`.
4. Run `codex -s read-only -a untrusted app-server` directly to see the argument error.

## System

- Omarchy 4.0.1-1
- Codex CLI 0.153.4
- Arch Linux, Hyprland 0.56.2