test(doc-slop): pin judge codex-home staging contract

[shunk031]

Summary

This is a regression-pinning PR, not a production bug fix. Current main already delegates judge-home staging to agent_guidance_eval.initialize_codex_home.

The new tests exercise that path through doc_slop_review.review_with_model and pin the contract:

• CODEX_HOME, when set, is the fixture source; the default remains ~/.codex.
• A staged judge home contains only config.toml and auth.json when those source files exist.
• Source file contents and permission bits are preserved, while unrelated files and directories are not copied.

The investigation also clarified an empirical source of confusion: sqlite state and related files seen in leftover staged homes can be created at runtime by the judge Codex process. Their presence does not prove that the runner copied the source home wholesale. In the live environment, auth.json is absent because authentication uses the configured command helper.

Validation

• uv run --python 3.14.6 --no-project python -m unittest discover -s tests/python -p 'test_*.py': 93 tests passed.
• prek run agent-guidance-validate --all-files: passed.
• prek run agent-guidance-eval --all-files: passed with a cache-local temporary CODEX_HOME and AGENT_GUIDANCE_EVAL_SANDBOX=danger-full-access; temporary state was removed afterward.
• Complete doc_slop_review.py on this body: passed with model consultation and zero findings.

Coordination

PR #655 changes the judge prompt, and PR #658 changes the deterministic textlint area in the same script. Whichever of those three PRs lands last must update-branch from current main, rerun the complete validation, and re-verify the staging contract.

Do not claim this PR fixes the original bug; it pins the already-correct current-main behavior.