Purge legacy ocw-managed sections from ~/.codex/config.toml on onboard

[anilmurty]

Summary

Found while running `tests/manual-pre-release-testing.md` — the Codex CLI integration block.

Before the rebrand, the legacy `ocw onboard --codex` wrote two blocks to `~/.codex/config.toml`:

```toml
[otel]

Managed by ocw — do not edit this block manually

log_user_prompt = false

[mcp_servers.ocw]

Managed by ocw — gives Codex access to OCW observability tools

command = "ocw"
args = ["mcp"]
```

After the rebrand, `tj onboard --codex` correctly appends the new `[mcp_servers.tj]` block but does not touch the legacy `ocw` sections. The result is a Codex config carrying both blocks side by side. The orphan `[mcp_servers.ocw]` points at `command = "ocw"`, a binary that no longer exists — so Codex will try (and fail) to spawn a phantom MCP server on every launch.

Re-running `tj onboard --codex` doesn't help: the "already has `[otel]` and `[mcp_servers.tj]` sections" early-return triggers and the legacy sections persist forever.

Fix

New helper `_codex_purge_legacy_ocw()`:

• Unconditionally strips the entire `[mcp_servers.ocw]` section (and any nested tables) on every `tj onboard --codex`.
• Strips the `[otel]` block tree only when it carries the `# Managed by ocw` comment, so user-authored or tj-managed `[otel]` blocks are left alone.
• Collapses any extra blank lines the removals leave behind.

Wired into `_onboard_codex` right after reading the existing config: if anything was purged, the cleaned file is persisted immediately — so the "already configured" early-return path no longer carries the legacy sections forward.

Test plan

• `pytest tests/unit/ tests/synthetic/ tests/agents/ tests/integration/` → 409 passed (added 6 new tests)
• `ruff check tokenjam/` → clean
• New tests cover:
  • Empty content → unchanged
  • Already-clean tj config → unchanged (substantively)
  • Legacy `[mcp_servers.ocw]` → dropped, sibling `[mcp_servers.tj]` preserved
  • Legacy `[otel]` marked `Managed by ocw` → entire tree dropped
  • `[otel]` NOT marked `Managed by ocw` → preserved
  • End-to-end repro of the actual file from manual testing (both blocks present, mixed) → all ocw-marked sections gone, tj sections survive

Manual verification (after merge)

For users who already onboarded pre-rebrand, the next `tj onboard --codex` will silently clean up their config. Sanity check after merge:

```bash
tj onboard --codex # any args
grep -E "Managed by ocw|mcp_servers\.ocw" ~/.codex/config.toml # should be empty
```

🤖 Filed via Claude Code while testing