feat: in-process Lua core handler for codex (#47, phase 3)

[Cannon07]

Summary

Flips Codex's PreToolUse / PostToolUse hooks from per-shim bash translation to a single RPC into the in-process Lua orchestrator, matching the pattern already shipped for claudecode (#63), opencode (#65), and copilot (#66). Refs #47 (phase 3). No behaviour change for codex users.

Changes

• backends/codex/code-{preview,close}-diff.sh — trimmed to the copilot shape: set -uo pipefail (no -e), fast-path filter for read/view/glob/grep/ls/list_files plus mcp__*, socket discovery, then a single nvim_call into pre_tool / post_tool. Abstains silently (exit 0, no stdout) when nvim is unreachable so codex falls back to its native ask-before-write loop.
• lua/code-preview/pre_tool/normalisers.lua — new codex entry. Codex's payload is almost canonical (top-level tool_name, cwd, tool_input); the only real translation is apply_patch → ApplyPatch with tool_input.command moved to tool_input.patch_text. Edit / Write / Bash / ApplyPatch are passthrough. file_path runs through resolve_path so internal keys (active_diffs, changes registry) compare equal across backends. Blank file_path / command / patch text drop tool_name to nil — matches the old shim's [[ -z "$FP" ]] && exit 0 guards.
• lua/code-preview/pre_tool/emitters.lua — explicit codex = none entry (mirrors copilot). Codex has no review-gate analogue to emit a permissionDecision for.
• tests/plugin/pre_tool_normaliser_spec.lua — new describe block covering apply_patch translation, ApplyPatch/Edit/Write/Bash passthrough, blank-field defenses dropping tool_name, mcp__* and noise tools yielding nil.

Notable: latent ApplyPatch bug fixed in passing

The old bash shim's ApplyPatch|Edit|Write) case blank-checked tool_input.file_path, which canonical ApplyPatch doesn't carry (it carries patch_text). So any payload using the canonical tool name would have been silently dropped on the empty-file_path guard. Dormant because nothing emits canonical ApplyPatch today (codex always uses lowercase apply_patch with tool_input.command), but the new normaliser checks patch_text correctly on that branch.

Followup commit (review nits)

dba4bee: refresh test docstrings to point at the in-process Lua normaliser instead of the old bin/core-pre-tool.sh adapter (parity with #66's followup for copilot), and add the path-normalisation note above the codex block so the resolve_path call doesn't look magical.

Test plan

• ./tests/run_lua.sh — all green (12 codex normaliser cases + existing suites)
• ./tests/run.sh — 68/68 including existing codex E2E (test_apply_patch.sh, test_edit.sh, test_install.sh)
• Manual Codex CLI session: apply_patch Update/Add/Delete opens diff, accept/reject clears registry, view/glob/mcp__ tools stay quiet, nvim-not-running case falls back to codex's native flow, VisibleOnly mode behaves as expected.

🤖 Generated with Claude Code