Add runtime auth profile selection

[shiny-code-bot]

Summary

• add --auth-profile NAME to shared runtime CLI options for TUI/exec sessions
• keep Config.codex_home as the base Codex Lab state root while adding Config.auth_home for credential storage
• split cloud-config bundle loading so cache/state stays under base CODEX_LAB_HOME while auth reads can use the selected profile
• preserve auth_home across in-process app-server config reloads, fallback config, and session-layer rebuilds

Validation

• cargo check -p codex-cloud-config -p codex-app-server -p codex-core -p codex-exec -p codex-tui -p codex-utils-cli
• cargo test -p codex-app-server config_manager --lib --no-run
• cargo test -p codex-core config_builder_auth_home_overrides_auth_storage_only --lib
• cargo test -p codex-tui auth_profile_launch_cannot_reuse_implicit_local_daemon --lib

Review

• first review pass caught cloud-config cache/auth home conflation and ConfigManager reload drift; fixed
• second review pass caught session-layer rebuild, fallback config, and test-helper auth-home drift; fixed