[4/5] Inspect bundled Codex CLI correctly

[ebarti]

Summary

• map the openai-codex-cli-bin distribution to its real codex_cli_bin import module
• use that module consistently for current and isolated API snapshots
• require metadata, module import, bundled_codex_path(), and an existing regular file before the binary probe passes
• preserve the binary-distribution probe identity for every in-process and embedded failure path
• keep success evidence stable without persisting temporary executable paths
• serialize binary-probe failures with bounded exception context while redacting everything from the first absolute POSIX, drive, UNC, or URL path start

Stack

• Depends on [3/5] Make SDK evolution evidence fail closed #53
• This is layer 4 of 5 in the SDK evolution demo reliability stack

Review notes

Two correctness passes covered wrong-module snapshots, metadata/import/helper/conversion/file-check failures, invalid helper returns, regular-file semantics, embedded probe labels, cross-platform path forms, diagnostic bounds, and path-bearing messages with spaces. No actionable findings remain.

Validation

• PYTHONPATH=. .venv/bin/python -m pytest -q — 477 passed, 8 skipped
• SDK evolution test file — 114 passed
• Codex CLI focused selection — 23 passed
• real installed locked Codex wheel snapshot/probe — passed
• .venv/bin/ruff check .
• .venv/bin/mypy
• git diff --check

Security-diff scans were intentionally not part of this phase review.