docs: add OpenAI Codex MCP onboarding

[marmar9615-cloud]

Summary

AgentBridge already worked with OpenAI Codex at the protocol level
because the bundled MCP server speaks stdio and Codex can launch
any stdio MCP server. This PR closes the onboarding gap:

• A dedicated Codex setup doc (docs/codex-setup.md)
• Copy-pasteable config.toml snippets (global + project-scoped)
• A model-neutral AGENTS.md sibling to the existing
  CLAUDE.md
• An experimental local Codex plugin skeleton
• An updated agentbridge mcp-config CLI command that emits Codex
  configs alongside the existing Claude Desktop / Cursor snippets
• Per-package and root README updates so the npm pages and the public
  README don't read as "Claude Desktop only"

No protocol, schema, or safety-behavior changes. Same five MCP
tools, four resources, four prompts, same confirmation tokens, same
origin pinning, same loopback-only default, same audit redaction,
same simulated destructive demo actions.

What changed

Docs (new + refactored)

• docs/codex-setup.md — three setup options (CLI codex mcp add, global ~/.codex/config.toml, project-scoped
  .codex/config.toml), demo-app pairing, prompt suggestions,
  troubleshooting, safety reminders.
• docs/mcp-client-setup.md restructured to be client-neutral
  with sections for OpenAI Codex, Claude Desktop, Cursor, and custom
  MCP clients, plus a "Safety expectations for all clients" block.
• AGENTS.md (root) — short, model-neutral working notes for any
  AI coding agent (Codex, Claude, Cursor, custom). Sibling to the
  deeper Claude-Code-focused CLAUDE.md.
• README.md gained a "Works with MCP clients" subsection, Codex
  one-liner, Cursor JSON, AGENTS.md row in the docs table.

Examples (new)

• examples/codex-config/ — config.global.toml,
  config.project.toml, README explaining when to use which.
• examples/codex-plugin/ — experimental local Codex plugin
  skeleton with .codex-plugin/plugin.json, .mcp.json, and
  skills/agentbridge/SKILL.md. Not a published plugin — the
  supported flow stays docs/codex-setup.md.
• examples/mcp-client-config/ README gained a Codex section;
  JSON snippets standardized on npx -y.

CLI

• agentbridge mcp-config now prints these blocks in order: raw
  stdio, OpenAI Codex CLI, OpenAI Codex config.toml, Claude
  Desktop, Cursor / generic JSON, local checkout, safety reminder.
• New CLI test in packages/cli/src/tests/cli.test.ts asserts each
  block is present in the output.

Per-package READMEs

• @marmarlabs/agentbridge-mcp-server and
  @marmarlabs/agentbridge-cli READMEs got new Codex setup
  sections.
• The other four publishable READMEs (core, sdk, scanner,
  openapi) updated their Status blocks to describe v0.2.2 as the
  Codex-onboarding release for consistency.

Versions

• All 9 workspace package.json files bumped 0.2.1 → 0.2.2 (six
  publishable packages plus root and the two private apps).
• package-lock.json refreshed.
• CHANGELOG.md entry and docs/releases/v0.2.2.md release notes
  added.

Workspace dependency ranges remain ^0.2.0 — 0.2.2 satisfies the
range, no consumer migration required.

What did NOT change

• ❌ No npm publish.
• ❌ No git tag.
• ❌ No GitHub release.
• ❌ No protocol, schema, or safety invariant changes.
• ❌ No code paths in apps/mcp-server/src/{tools,safety,confirmations, idempotency}.ts were touched.
• ❌ No demo destructive actions made real.
• ❌ Dependabot PRs (build(deps): Bump actions/checkout from 4 to 6 #3–build(deps): bump marked from 14.1.4 to 18.0.2 #9) untouched.

Local checks

• npm ci
• npm run typecheck:clean
• npm test — 87 passed (was 86 before; new mcp-config test)
• npm run build
• npm run pack:dry-run — all 6 tarballs validated at 0.2.2
• npm run smoke:external — PASS
• (cd apps/demo-app && npx next build) — passed
• (cd apps/studio && npx next build) — passed
• node packages/cli/dist/bin.js version → 0.2.2
• node packages/cli/dist/bin.js mcp-config — Codex CLI + Codex
  config.toml + Claude Desktop + Cursor + raw stdio + local checkout
  • safety reminder all printed
• node packages/cli/dist/bin.js validate ... → ✓ valid manifest
• node packages/cli/dist/bin.js generate openapi ... → 4 actions
• node apps/mcp-server/dist/index.js < /dev/null → exits cleanly

Codex setup commands users will see

# CLI one-liner
codex mcp add agentbridge -- npx -y @marmarlabs/agentbridge-mcp-server

# ~/.codex/config.toml or .codex/config.toml
[mcp_servers.agentbridge]
command = "npx"
args = ["-y", "@marmarlabs/agentbridge-mcp-server"]
startup_timeout_sec = 20
tool_timeout_sec = 60
enabled = true

Test plan

• CI passes on Node 20.x and 22.x
• Manual release-check workflow passes after merge to main
• After publish (separate manual step, not in this PR): npm view @marmarlabs/agentbridge-{...} version returns 0.2.2 and npm view ... readme shows the new Codex sections

🤖 Generated with Claude Code