Codex on co-located nodes cannot reach the control

The built-in Codex runner on a co-located (vnode) node does its work but cannot upload artifacts or settle. This blocks AC-1(b), "current agents keep working". It predates epic 5886: no commit from this epic touched the Codex adapter. **Reproduction (task 5909, dev task 4960):** - The Codex account ran a task on a co-located static node. It wrote its report, but every control MCP call failed. - The server dialled the default `/run/skynet/creds/sock`, which does not exist on a vnode. The vnode's socket is `$JAAH_CRED_SOCKET`. - The transcript (session 28af283e) downloads. **Cause (from reading the code):** - apps/jaahd/agent_socket.py:35-41 resolves the socket from the server process's own env (`environment.credential_socket_explicit()`, apps/jaahd/environment.py:352-368), falling back to the default. - Claude's plugin entry (apps/jaahd/mcp/jaah/.mcp.json:3-7) has no `env` block and inherits the session env, which is why Claude works. - Codex registers the server through apps/jaahd/agents/agent_layer.py:63-75 `mcp_add_argv`, which takes no `--env`. - apps/jaahd/agents/codex.py:452-457 and :592-597 pass only `CODEX_HOME`. Codex starts stdio MCP servers with a filtered env, so `JAAH_CRED_SOCKET` never reaches the server. This is likely; confirm it with a logged env. **Fix:** make the Codex control server see this node's socket. The registration is per-account (`mcp_servers.control` in config.toml, codex.py:204-209) while the socket is per-vnode, so a socket path baked into a shared config is wrong. Pick one of these and record why: - launch the server through a wrapper that resolves the socket from the node's own env or run root; - add the `env_vars`/`--env` passthrough for `JAAH_CRED_SOCKET` that Codex supports for stdio servers. Keep Claude's path byte-identical. Out of scope: rewriting the Codex adapter (epic fence N1 allows only this fix), other providers, and MicroVM nodes. Done means: - On dev, a Codex-account task on a co-located node uploads its report and settles `done`. Cite the task id and its session in Audit > Sessions. - A unit test asserts the Codex registration/launch makes `JAAH_CRED_SOCKET` (or the wrapper) reach the server. - apps/jaahd/tests/test_agent_adapters.py is not weakened. - `env -u JAAH_PROJECT_MEMORY ./dc check full` is green, the PR is merged to develop, and Jaah Deploy to dev is green.

Codex control MCP now forwards JAAH_CRED_SOCKET (env_vars, by name; old accounts self-heal). PR #5205 merged, dev deploy green; dev task 4984 (Codex, vnode swarm-p2) uploaded its report and settled Done. Frontend lane timed out locally on load; PR CI green. 4 UI follow-ups in the report.